[ Security Vulnerability ] SpyPhone – trojan for non jailbroken devices

A Swiss iPhone developer has unveiled a new application SpyPhone that is capable of harvesting huge amounts of personal data from iPhones, including data like

• geolocation data
• passwords
• address book entries
• email accounts information
• images
• Safari Browsing history
• youtube related data
• keyboard logger, etc

via wmexperts.com

SpyPhone trojan for non jailbroken devices

In oder for SpyPhone, to work, it does not need any exploits or any jailbreaking/firmware modification, attacks in order to access the iPhone’s data. Instead, SpyPhone relies on using the iPhone’s usability and depth of features to its advantage, the app uses the public API exposed by Apple’s SDK. Once an application is on an iPhone, it has unrestricted access to the large amount of the data and settings available on the device. SpyPhone is more like a Trojan sitting in your OS silently and stealing data. All of the SpyPhone’s operations are executed in the background, without the knowledge of the iPhone’s owner, and just like any other Trojan, the application can be set to email reports on each infected phone back to the attacker.

Seriot, the application developer, has posted the source code for SpyPhone online. Which increases the risk of the app being used by malicious hackers in their dodgy apps that might end up in the app store.

Any app in the App Store may have this, making it very hard for Apple to eradicate the issue.

Tagged as: open source, spyPhone, trojan