Apple has a secret system:
An API that spies on you and your devices.
I know… because I built it.
I designed the API to detect acts of intent, But it sees everything.
Everyday choices from ordinary people. People like you.
Actions that others consider irrelevant.
Advertisers wouldn't stop. So I decided I would stop them.
I needed to eliminate the competition.
Those with the skills to intervene.
Hunted by regulators, we work in secret.
But user or Advertiser, if your iPhone is up,
we'll find you.
You are watching episode 001 of the [REDACTED] Hacker.
Stick around.
Or don't.
I know where you live...
[The
Redacted Hacker Intro Music]
I'm Brenton House and you are watching the Redacted Hacker.
Is Apple spying you you? Let's take a look.
In 2020, Apple claimed they wanted to clean up the privacy issues related
to the tracking of consumer actions and behaviors while using the iPhone.
They restricted access to an API that was highly used by advertisers such as Facebook and others.
After severely handicapping the competition and building their own advertising empire, researchers
recently discovered that Apple actually created a new, secret API that only they have access to,
and it sends identifiable information about users, their actions, and behaviors... to Apple.
Let's go a little deeper into this story to understand what is at stake here.
The big change for Apple in 2021 was their App Tracking
Transparency API that controlled access to the "Identifier for Advertisers" or the IDFA.
The IDFA is an ID that allows apps and APIs
to uniquely identify a user across multiple apps, websites, and APIs.
However, this API was not only used by advertisers but was also used
by organizations and developers for purposes of fraud detection.
Apple now required all apps to prompt users for permission to
track them before providing access to this identifier.
As expected, the percentage of apps that were able
to successfully use this API and ID dropped significantly.
At the same time, Apple started adding their own ads to their App Store.
With other advertisers cut out of the game, Apple was able to
tap into a wealth of advertising dollars that previously went to the competition.
But the value and effectiveness of ads depends on the kind of data you can use.
What we didn't know at the time was the Apple had created a new,
secret API that only they would have access to.
This new API was discovered by researchers and they found that Apple is using this
new API to send across information that includes actions taken by a user AND a new,
unchangeable ID that can identify a user and device.
Does Apple prompt users to ask permission to track them in the
same fashion that they require of the competition?
No.
What is also interesting is that this information is collected by Apple EVEN IF
the user turns off the settings for sharing analytics and personalized recommendations.
It has also been verified that this occurs in the latest version of iOS 16 as well.
For more, let's take a look at the exclusive report from Gizmodo.
--------------
According to Gizmodo:
A new test of how Apple gathers usage data from iPhones has found that the company collects
personally identifiable information while explicitly promising not to.
The privacy policy governing Apple’s device analytics says "none of the
collected information identifies you personally".
But an analysis of the data sent to Apple shows it includes a permanent,
unchangeable ID number called a Directory Services Identifier,
or DSID, according to researchers from the software company Mysk.
Apple collects that same ID number along with information for your Apple ID,
which means the DSID is directly tied to your full name, phone number, birth date,
email address and more, according to Mysk’s tests.
The iPhone Analytics setting makes an explicit promise: Turn it off,
and Apple says that it will "disable the sharing of Device Analytics altogether".
However, two app developers and security researchers at the software company Mysk,
took a look at the data collected by a number of Apple iPhone apps including the App Store,
Apple Music, Apple TV, Books, and Stocks.
They found the analytics control and other privacy settings had no obvious effect on Apple’s
data collection. The tracking remained the same whether iPhone Analytics was switched on or off.
According to Apple’s analytics policy, "Personal data is either not logged at
all, is subject to privacy-preserving techniques such as differential privacy,
or is removed from any reports before they’re sent to Apple"
But Mysk’s tests show that the DSID, which is directly tied to your name,
is sent to Apple in the same packet as all the other analytics information.
--------------
Now, you might be wondering how Mysk and his team
were able to see this information in the API that Apple was using.
Although the article does not state what tools he used,
I can give you a quick breakdown of how you could do this yourself.
There are several tools that allow you to snoop on API calls being
used by iOS app made by Apple or any other publisher. My favorite is called Charles.
Now Charles is a macOS app that acts as a proxy to intercept calls being made on
your macOS machine but they also released a mobile app, aptly named, "Charles Mobile".
With this app you can see that Apple is making these calls to the endpoint that Mysk described.
However, the contents of these calls are going to be encrypted
as Apple is using SSL and certificate pinning to secure these API calls.
To get around this, you would need to use an iOS device that is jail-broken.
Now, the process of jail breaking your iOS device is risky and carries
the possibility that you might brick your phone.
It also probably invalidates any warranty that you might have with Apple.
If you watch these same API calls on one of these devices, however,
it gives you much more power to mess with the certificates and other settings,
and to be able to read the contents of these API calls.
So how bad is this data that Apple is sending?
Continuing with the Gizmodo article:
--------------
Tommy Mysk, an app developer and security researcher, who ran the test said:
“Knowing the DSID is like knowing your name. It’s one-to-one to your identity.
All these detailed analytics are going to be linked directly to you. And that’s a problem,
because there’s no way to switch it off.”
The App Store appeared to harvest information about every single thing you did in real time,
including what you tapped on, which apps you search for, what ads you saw,
and how long you looked at a given app and how you found it.
The app sent details about you and your device as well,
including ID numbers, what kind of phone you’re using, your screen resolution,
your keyboard languages, and how you’re connected to the internet.
Notably, THIS kind of information is commonly used for what is called "device fingerprinting".
Mysk said: “Opting-out or switching the personalization options off did
not reduce the amount of detailed analytics that the app was sending. I switched all
the possible options off, namely personalized ads,
personalized recommendations, and sharing usage data and analytics.”
It’s impossible to know what Apple is doing with the data without the company’s own explanation,
and as is so often the case, Apple has been silent so far.
It’s entirely possible that Apple doesn’t use the information if you turn the settings off,
BUT that’s not how the company explains what the settings do in its privacy policy.
Privacy is one of the main issues that Apple uses to set its products apart from competitors.
They ran 40-foot billboards of the iPhone with the simple slogan
“Privacy. That’s iPhone.” and ran the ads across the world for months.
But the company is slowly introducing many of the internet’s privacy issues into Apple ecosystem.
Apple is working hard to build an advertising empire. Apple’s ad network runs on your personal
information just like the ones Google and Meta operate, albeit in a more reserved way.
Along the way, Apple developed a very convenient definition of what privacy means that lets the
company criticize its rivals’ privacy practices while harvesting your data for similar purposes.
Apple says you shouldn’t think of what it does as “tracking.”
According to the company’s website:
Apple’s advertising platform does not track you,
meaning that it does not link user or device data collected from our apps with user or
device data collected from third parties for targeted advertising or advertising
measurement purposes, and does not share user or device data with data brokers.
In other words, it’s not tracking unless you’re
linking together data collected from services owned by different companies.
If only one company, say Apple, is collecting the data,
then by Apple’s definition, it’s not tracking.
Of course, that’s different from the definition of tracking that everyone else seems to use.
--------------
If you are interested in turning on the iPhone
privacy settings that are meant to stop analytics from being shared,
Open up your iPhone’s settings,
tap “Privacy & Security,” and scroll down to “Analytics & Improvements.”
There you’ll find a setting labeled: “Share iPhone Analytics.”
I recommend turning this setting off.
Now, If you are testing your device, go ahead and toggle it on and off all you want.
Tests from Mysk found that Apple collects device analytics data,
no matter how you adjust this control.
Also, in recent experiments with the latest versions of macOS,
Mysk has found that Apple is using this API with macOS to send the DSID, which again,
is tied to a user's Apple and iCloud account.
In a follow-up to Gizmo's initial article about this new API,
at least a dozen class-action lawsuits has been filed in federal court against Apple.
We will be keeping a close eye on this developing story and keep you in-the-loop.
---------------
Check out the show notes for more info and links to the videos provided by Mysk
that shows the information that Apple is harvesting in real-time.
Subscribe to The Redacted Hacker to learn more about
the cybersecurity stories behind today's headlines.
My name is Brenton House.
I was never here and we never had this conversation.