{"id":3498,"date":"2014-06-12T10:00:06","date_gmt":"2014-06-12T14:00:06","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=3498"},"modified":"2020-02-26T18:58:42","modified_gmt":"2020-02-26T14:58:42","slug":"security_in_apple_ios8","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/security_in_apple_ios8\/3498\/","title":{"rendered":"Security in Apple&#8217;s iOS 8"},"content":{"rendered":"<p>As it always does, Apple unveiled the latest iteration of its mobile operating system at the World Wide Developers conference last week. The Cupertino, California computer company is calling iOS 8 \u201cthe world\u2019s most advanced mobile operating system.\u201d That claim is obviously debatable, but the platform does include some well-thought-out security and privacy features as well as a significant retooling of the application development environment.<\/p>\n<p style=\"text-align: center\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/06\/05111340\/ios8-compressor-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-5087\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/06\/05111340\/ios8-compressor-1.png\" alt=\"ios8-compressor\" width=\"640\" height=\"480\"><\/a><\/p>\n<p>The strongest security and privacy upgrade is also probably the least likely to be noticed by users: <a href=\"https:\/\/threatpost.com\/ios-8-will-randomize-mac-addresses-to-help-stop-tracking\/106527\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">media access control (MAC) address randomization.<\/a> MAC addresses are unique identifiers that have been widely used to track devices and user behavior across Wi-Fi networks. Retailers and others reportedly track MAC addresses to learn more about the behaviors of their customers as they connect to and interact with public Wi-Fi networks.<\/p>\n<p>Problematically, many users have no idea this tracking is going on, which means they probably aren\u2019t consenting to it, at least not in the traditional sense.<\/p>\n<p>In iOS 8, iDevices will generate random MAC addresses as they are scanned by wireless networks. The move will quietly make it impossible for retailers to track in-store customer movement and other behaviors. MAC address randomization is a huge privacy upgrade for many Apple fans who won\u2019t even realize it is happening.\u00a0<\/p><blockquote class=\"twitter-pullquote\"><p>MAC address randomization is a huge #privacy upgrade for many #Apple fans who won\u2019t even realize it is happening.<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2Ffuj9&amp;text=MAC+address+randomization+is+a+huge+%23privacy+upgrade+for+many+%23Apple+fans+who+won%26%238217%3Bt+even+realize+it+is+happening.\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>Another nice security and privacy upgrade will let users establish DuckDuckGo as their default search engine in Safari. DuckDuckGo is <a href=\"https:\/\/www.kaspersky.com\/blog\/alternative-browsers\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">an alternative search engine<\/a> that does not collect user information based on search queries or any other information for that matter. Furthermore, when possible, DuckDuckGo also makes sure that users i<a href=\"https:\/\/www.kaspersky.com\/blog\/digital-certificates-httpss\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">nteract with websites securely via an encrypted HTTPS connection.<\/a> Searches on DuckDuckGo are more organic \u2013 in a sense \u2013 because your queries are not tailored to your perceived interested, as is often the case with other engines.<\/p>\n<p>Of course, the release is stuffed full of flashier and more utilitarian features as well. Photos will be shared across all connected devices, users will be able to easily add voice to text messages (which is what I thought phone calls were for), and the company is touting a new and cleaner notification interface. Obviously photo-sharing across devices could present privacy and security issues down the line, but there isn\u2019t much of a security angle there at the moment.<\/p>\n<p>However, some of the new keyboard features along with family sharing, deeper iCloud integration, and the new platform\u2019s clear ambition to attract increased application development could have serious implications.<\/p>\n<p>The company claims its new software developers kit (SDK) as the biggest ever since the App Store\u2019s initial launch, with more than 4000 application programming interfaces (API). If we understand their <a href=\"https:\/\/www.apple.com\/pr\/library\/2014\/06\/02Apple-Unveils-iOS-8-the-Biggest-Release-Since-the-Launch-of-the-App-Store.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">press releases<\/a> correctly, these moves along with a new app programming language will likely turn the App Store into a more open, Google Play like atmosphere (however, Apple\u2019s premoderation policy is still in place). On the one hand that will mean more applications. On the other, this will mean further exposure to threats, which may or may not pose a risk to users depending on how Apple handles security in the changed environment.<\/p>\n<p>One of the new developer kits that we\u2019ll be keeping an eye on is \u201cHeathKit.\u201d This will let developers build health and fitness applications better suited to communicate with one another, sharing various sorts of information about users from their workout routines to their blood pressure. There\u2019s been an explosion of health and fitness applications on the market in recent years. However, our interest was initially piqued last month when the United States Federal Trade Commission issued a report warning that these<a href=\"https:\/\/threatpost.com\/health-and-fitness-apps-poor-at-protecting-privacy-ftc-says\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"> health and fitness apps are bit grabby when it comes to taking and sharing user information. <\/a>Giving different applications the ability to share this data with each other \u2013 even if users are permitting them to do so, in as much as granting permissions actually counts as giving consent \u2013 can only exacerbate the problem. To be fair though, if shedding some personal data means you will exercise more, then this is probably a solid trade-off.<\/p>\n<p>HomeKit is another one of these APIs of concern. It will empower developers to build applications that interact with the increased connectivity and \u201csmartness\u201d of modern homes. If you read the Kaspersky Daily with any degree of regularity, then you know that <a href=\"https:\/\/www.kaspersky.com\/blog\/study-smart-homes-insecure\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">home automation systems have a poor track record with security.<\/a> Apple claims this is all securely paired \u2013 likely meaning encryption is used in some way \u2013 and configured, but it\u2019s hard to say how secure something is before it hits the open market.<\/p>\n<div class=\"pullquote\">If the new App Store is open for business in the way that Android is, then we may see more malicious applications moving forward.<\/div>\n<p>All in all, this new version really does seem like a complete overhaul on Apple\u2019s existing development environment, which is exciting because it means newer and more innovative apps, including third-party keyboards, widgets, etc. However, it\u2019s a bit frightening as well, because with innovation comes more attack surface and more troubling attacks. As we alluded to above, if the new App Store is open for business in the way that Android is, then we may see more malicious applications moving forward.<\/p>\n<p>If you want to get into the real nitty-gritty of how all this new application development business will impact security \u2013 particularly in comparison to Android \u2013 then check out the second page of this extensive <a href=\"http:\/\/arstechnica.com\/apple\/2014\/06\/explaining-ios-8s-extensions-opening-the-platform-while-keeping-it-secure\/2\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Ars Technica article by Andrew Cunningham.<\/a><br>\nBeyond what we\u2019ve already discussed, when using the new keyboard \u201cyou\u2019ll see choices of words or phrases you\u2019d probably type next, based on your past conversations and writing style.\u201d In addition to that \u201ciOS 8 takes into account the casual style you might use in Messages and the more formal language you probably use in Mail\u201d and \u201calso adjusts based on the person you\u2019re communicating with, because your choice of words is likely more laid back with your spouse than with your boss.\u201d Altogether, these features mean that Apple will be gathering more information about you, which must count as a detraction from privacy, no matter how convenient. iCloud\u2019s increased file storage capacity means you\u2019ll be storing more sensitive information in a single place, which will increase the need to familiarize yourself with and <a href=\"https:\/\/www.kaspersky.com\/blog\/what_is_two_factor_authentication\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">enable the security features<\/a> offered by that service. But is also means more avenues to back up and protect your sensitive data as well.<\/p>\n<p>The new Family Share feature will give users the ability to essentially sync their devices with other users they have established as members of their family. Outside the fairly clear risks and further parental control benefits this sort of setup will enable, it also opens up a new potential attack vector \u2013 similar to recent reports in which <a href=\"https:\/\/www.kaspersky.com\/blog\/ransomware_targets_ios_osx\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">attackers leveraged iCloud access<\/a> to lock phones. We will be interested in seeing whether or not it is possible for attackers to surreptitiously establish themselves as family members in order to monitor user behavior and steal device data.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Discussing security and the privacy strengths and weaknesses in the Apple\u2019s soon-to-be-released iOS 8.<\/p>\n","protected":false},"author":42,"featured_media":3499,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[672,1061,673,555,43,97],"class_list":{"0":"post-3498","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-apple-apple-security","9":"tag-ios","10":"tag-ios-8","11":"tag-mobile-2","12":"tag-privacy","13":"tag-security-2"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/security_in_apple_ios8\/3498\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/security_in_apple_ios8\/3602\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/security_in_apple_ios8\/3938\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/security_in_apple_ios8\/4145\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/security_in_apple_ios8\/5086\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/security_in_apple_ios8\/3927\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/security_in_apple_ios8\/5086\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/security_in_apple_ios8\/5086\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/apple-apple-security\/","name":"apple apple security"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=3498"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3498\/revisions"}],"predecessor-version":[{"id":15810,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3498\/revisions\/15810"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/3499"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=3498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=3498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=3498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}