Cydia Apps Leak Less Private Data than iTunes Apps

February 16, 2012 10:01:52 AM

Unauthorized iPhone And iPad Apps Leak Private Data Less Often Than Approved Ones — www.forbes.com — Readability

www.readability.com

forbes.com

A screenshot of the ContactPrivacy feature in the unofficial Cydia iOS app platform.

Users have learned over the last few years that Apple's "walled garden" approach to third party apps isn't quite as protective of their sensitive data as it might sound. More surprising, perhaps, is another revelation: that the popular unauthorized apps outside those walls tend to respect privacy better than the approved ones inside.
After building a tool called PiOS that analyzes private data leaks from iOS apps, the researchers ran their analysis on 1,407 free apps–825 downloaded from Apple's App Store using the website App Tracker, and 526 accessible through BigBoss, the largest repository of unauthorized apps available to users through the Cydia app market for jailbroken iPhones and iPads.

A table from the UCSB study showing how frequently authorized App Store and unauthorized Cydia iOS apps leak private information.

Of those tested apps, 21 percent of official App Store apps uploaded the user's Unique Device Identifier, (UDID) a series of user-specific digits that can be tracked between apps to assemble a profile of a specific person's behavior. Four percent uploaded the device's location, and half a percent uploaded the user's contact list. When the researchers analyzed the unauthorized Cydia apps, on the other hand, only four percent leaked the user's UDID, and only one app out of the 500 tested–a program specifically designed for espionage called MobileSpy–leaked location or contact data.
But why would Cydia's unauthorized apps actually leak private data less often than those that Apple approves? Egele points to Cydia's culture of privacy among administrators and users. "The people who run Cydia seem very conscious of what information is available and can be accessed," says Egele. "The applications you get from Cydia are geared toward more privacy-aware people."
I've contacted Apple for comment and will update this post if I hear back from the company.
"If you care about this kind of thing, you should jailbreak your phone," says Freeman. "Instead of Apple making decisions about what's good and bad, you decide. People think jailbreaking is about deciding that things Apple doesn't like are good. But it  also allows you to decide that things Apple likes are bad. We provide you the tools to block the functionality you don't believe apps should have on your phone."

References

1. ^ news that the iPhone app Path uploads users' entire contact lists(thenextweb.com) ( http://thenextweb.com/apps/2012/02/07/path-2-uploads-your-address-book-but-says-that-its-for-friend-matching-and-will-be-opt-in-soon/ )
2. ^ here (seclab.cs.ucsb.edu) ( http://seclab.cs.ucsb.edu/media/uploads/papers/egele-ndss11.pdf )
3. ^ discovery by a Singaporean researcher that the social networking app Path uploads users' contact list (mclov.in) ( http://mclov.in/2012/02/08/path-uploads-your-entire-address-book-to-their-servers.html )
4. ^ using security flaws hackers find in iOS's code (www.forbes.com) ( http://www.forbes.com/sites/andygreenberg/2011/08/01/meet-comex-the-iphone-uber-hacker-who-keeps-outsmarting-apple/ )
5. ^ ContactPrivacy (www.cultofmac.com) ( http://www.cultofmac.com/145112/how-to-keep-apps-like-path-from-accessing-your-contacts-data-jailbreak/ )
6. ^ PrivaCy (cydia.saurik.com) ( http://cydia.saurik.com/package/com.saurik.privacy )
7. ^ here (seclab.cs.ucsb.edu) ( http://seclab.cs.ucsb.edu/media/uploads/papers/egele-ndss11.pdf )
8. As the scandal swirled this past week over news that the iPhone app Path uploads users' entire contact lists ¹ without permission, I came upon a study (PDF here ² ) released last year by a group of researchers at the University of California at Santa Barbara and the International Security Systems Lab that aimed to analyze how and where iPhone apps transmit users' private data. Not only did the researchers find that one in five of the free apps in Apple's app store upload private data back to the apps' creators that could potentially identify users and allow profiles to be built of their activities. They also discovered that programs in Cydia, the most popular platform for unauthorized apps that run only on "jailbroken" iPhones, tend to leak private data far less frequently than Apple's approved apps.
9. For Manuel Egele, a post-doctoral researcher at UCSB, the discovery by a Singaporean researcher that the social networking app Path uploads users' contact list ³ only confirms a pattern he and his co-authors have long seen. Four of the Apple-approved apps he tested last year were found to similarly upload contacts, including one from the location-based social network Gowalla.  "Clearly this behavior hasn't changed over the last year. I'm not sure whether there's been any improvement from Apple's side," Egele says. "For easily accessible data, app store apps are much more frequently accessing and leaking that data. The app store is supposed to be a walled garden. Unless Apple gives approval, you can't put things there. But whatever job the company is doing isn't good enough."
10. With somewhere between 10 million and 15 million users, Cydia's app platform has become the default unofficial app store of users who jailbreak their iPhones and iPads, hacking them to install applications and operating system tweaks that Apple restrictions are designed to block. That kind of device hacking, using security flaws hackers find in iOS's code ⁴ to unlock its restrictions against running unapproved code, also introduces new security and privacy risks for users by stripping away the phone or tablet's security features and leaving the device open to malware.
11. But Jay Freeman, Cydia's creator, points to numerous applications available via Cydia that actually give users privacy and security features they wouldn't otherwise have. Immediately after the Path scandal broke, for instance, a developer named Ryan Petrich created a tweak for Cydia called ContactPrivacy ⁵that warns the user whenever an application wants to upload his or her contact information, (shown above) rather than simply allowing the data to be transmitted by default. Another app that Freeman wrote himself, called PrivaCy ⁶ , gives the users a toggle switch that allows them to control whether any particular app can upload usage statistics to a remote server.
12. Read the study from the International Security Systems Lab and the University of California at Santa Barbara here ⁷ .

Original URL:

http://www.forbes.com/sites/andygreenberg/2012/02/14/unauthorized-iphone-and-ipad-apps-leak-private-data-less-often-than-approved-ones/

February 13, 2012 3:00:32 PM

Fair Labor Association begins Foxconn inspections at Apple's request

www.tuaw.com

Apple has announced that the Fair Labor Association will conduct voluntary audits of Foxconn factories in Shenzhen and Chengdu, China, at Apple's request. Inspections began Monday in Shenzhen.
In a press release issued this morning, Apple CEO Tim Cook said, "The inspections now underway are unprecedented in the electronics industry, both in scale and scope, and we appreciate the FLA agreeing to take the unusual step of identifying the factories in their reports."
The FLA's inspection procedure will consist of three main parts. Interviews with employees regarding living conditions, work place safety, compensation and hours; physical inspections of dormitories and work areas; and review of documents "…related to procedures at all stages of employment."
Apple recently came under fire for working conditions at some of its assembly partners' plants, prompting some concerned customers to deliver petitions to Apple Stores .

PaperKarma: Stops Junk Main with a Snap of a Photo [FREE - For Now]

PaperKarma Stops Junk Mail with a Snap of a Photo

iOS/Android/WP7: Nobody likes junk mail, but if you're too lazy to go through and unsubscribe to everything individually, PaperKarma is a new app that only requires you to take a picture of the offending mail to remove yourself from the junk mail database.
PaperKarma works on magazines, catalogs, coupons, fliers, credit card offers, and even the Yellow Pages. To sign up for the service, you need to hand over a bit of your own information, including your address and email. Once you do, all you need to do is snap a picture of the junk mail in your mailbox and PaperKarma unsubscribes you from the list. The nice thing is that you can pick and choose what you unsubscribe from. If you like getting a particular catalog, you can keep it on your list.

It's currently a free download for iPhone , Android , and Windows Phone 7 .

PaperKarma | via TechCrunch

To Top

Black SMS Encrypt Text Messages TXT MSG on iOS iPhone

February 9, 2012 8:18:24 PM

Black SMS Encrypts and Decrypts Your Text Messages

lifehacker.com

iOS: Anyone can pick up your phone and read your text messages. It's also not that difficult for someone to install spy software or for the U.S. government to acquire your messages from your carrier. If you want to keep your text messages private, Black SMS is an app that provides a very simple method for doing so. You simply type in the message, set a password, and send it over to iMessage. The recipient can then use their copy of Black SMS to decrypt the message using the password you set by simply pasting the message into the app and entering the password. (Watch the video above for a demonstration.)
This is a very helpful tool when you're exchanging sensitive data over SMS. You probably won't feel the need to use it for every single text message you use, as the process is a little bit tedious for quick, everyday communication. Nonetheless, when you've got something private to share, Black SMS can help you keep it that way.
Note: A free decrypt-only version of Black SMS will be available soon, but for now you can get the regular version for $1.
Black SMS ($1) | iTunes App Store

February 9, 2012 7:59:12 PM

Copy Photo Stream Images to a Folder Automatically

lifehacker.com

Apple's Photo Stream service for iCloud is a great way to keep your photos on your iPhone in sync with your computer, but it requires you use the newest version of iPhoto. If you're not a fan of iPhoto, Macworld forum member DJF3 came up with a script to automate the process and skip iPhoto.
To use this, you need a copy of iLife '11 installed and Photo Stream turned on in iCloud (Settings > iCloud). You also need to do a little scripting yourself. Open Apple Script Editor (Applications > Utilities) and paste in the following code:

tell application "Finder"   set this_folder to "Macintosh HD:Users:user:Library:Application Support:iLifeAssetManagement:assets" as alias   set target_folder to "Macintosh HD:Users:user:Pictures:MyStream" as alias   try     duplicate (every file of the entire contents of this_folder whose name contains "IMG") to the target_folder with replacing   end try end tell

Before you're finished, you have to replace the target path folder (Macintosh HD:Users:user:Pictures:MyStream) to the folder of your choosing on your hard drive.
Click run in Automator and it should copy all your Photo Stream files over to the MyStream folder inside your Pictures folder. You can edit the location to anywhere you like by changing the "Macintosh HD" line. It's not a bad replacement if you're looking to skip the iPhoto step to get your photos from your Photo Stream to a folder. Find more information, help, and a couple other ways to do the same thing over at Macworld.
10.7 Auto-copy Photo Stream images to a folder | Mac OS X Hints

5 Photography Tips and Tricks Everyone Should Know

February 9, 2012 7:25:04 PM

Pro Tips for Regular People: Five Photography Tricks Anyone Who Owns a Camera Should Know

lifehacker.com

A camera is only as capable as the person using it, but snapping some awesome images doesn't require years of training. Here are five photography pro tips that everybody ought to know.

Think Before You Shoot to Compose Your Images Like a Pro

Taking tons of pictures may seem like a good idea when you're trying to capture the perfect moment, but when you transfer all those photos to your computer and start looking through them all you're going to wish you hadn't. Too many images is always a burden later. Unless you need to act fast, it's almost always better to think before you shoot. If you take the time to compose your shot, rather than hold down your shutter and hope for the best, you'll end up with the photo you want and less work to do when you're back at your computer.
The most common composition technique is known as the rule of thirds . The basic idea is that you split your frame into three equal horizontal sections and three equal vertical sections. This creates a grid of nine boxes and four main points of intersection, as you can see in the example on the right. Those four points of intersection are areas that tend to draw the eye, and that's where you want to place your subject. As you can also see from the example, there's a star on the point of intersection that draws your eyes right to my friend's face (or, more specifically, her eyes). Your goal with the rule of thirds is to do the same.

Another option is to use a Fibonacci spiral to find an optimal location for your subject. If you imagine the spiral on top of your frame, you'll want to place your subject in the smallest point. This is where the eye of the viewer will go. You can see an example to the right.
These are just a few simple tips for getting better composition, but composition involves more than just knowing where to place your subject. Perspective, objects other than the subject, and the message you want to convey all play a role in creating great images. For more helpful composition tips, read this .

Shoot with the Light Behind You

If you've ever looked directly into a source of light, you know it's not only unpleasant but makes it harder to see much else around you. This is why we have the phrase "blinded by the light." This same problem applies to your camera. If you point it at a light source, it'll have trouble seeing everything else. Whether it's the sun or just a bright lamp, whenever you notice a bright light in your frame just move so the light is behind you rather than your subject. Sometimes this will take a little rearranging, but it'll make your image more visible (because it isn't being backlit) and generally add nice light on your subjects. It's a win-win.

Know Your Settings to Achieve Better Low Light Images

Nobody is carrying a lighting kit around on their back for everyday photos, and most people don't want to use a flash to brighten up a scene because it washes out the photo and generally makes things look worse. That said, you have to do something when you're in a low light situation or your image will end up too dark to be worthwhile. Pros know how to optimize their camera's settings to make the best of a poor lighting situation and you can use that same knowledge to do the same.
The video on the left will explain these different settings and what they do, but here's the gist. The three settings that matter are aperture, shutter speed, and ISO. Almost every camera (with the exception of some cellphone cameras) will allow you to control the ISO. This is a number that represents how sensitive each exposure is to the light it captures. The higher the number, the more sensitive it is. In general you want to use a lower ISO because higher ISOs result in noisier photographs and lights that look like they're blown out. That said, that extra sensitivity can be a huge boon when you're lacking illumination. Simply set your cameras ISO to a higher number (400 is pretty standard for indoors, but you might go up to 800 and 1600 under darker circumstances) and snap the photo. This will help pull a little more light out of each picture.
Aperture and shutter speed are not user-settable on every camera, but they are on some. Aperture refers to how wide open the lens is, and a shutter speed refers to how long you expose the camera's sensor to light. A wider aperture means more light is let in to the camera. This also produces a more shallow depth of field (meaning less of the photo is in focus, which is often a desired result). If you can widen the aperture on your camera, you should when you need more light. This offers the fewest compromises in quality. If you still need more light, reducing the shutter speed can help but it comes with the disadvantage of potentially blurry photos. You can usually get away with a shutter speed as slow as 1/30th without worry about camera shake. That shutter speed will be too slow if you have a moving subject, however, and so you'll have to boost it up in that case. In general, 1/250th of a second is sufficient for capturing motion realistically. If you're using a slower shutter speed to capture images in lower light and you are experiencing blurring because you can't keep the camera still, pressing the shutter while exhaling can help to solve that problem.
Overall, low light photos are always going to turn out better if you've got a camera that's known to handle it. Nonetheless, utilizing these settings to your advantage should help you get better photos despite minimal illumination.

If You Have to Use a Flash, Use It Properly

As previously discussed, flashes bring about all sorts of problems. You'll generally end up with washed-out subjects who are far more illuminated than anything else in the image. Flashes are also the cause of red eyes. In general, it's best to avoid them whenever you can but there are some things you can do to get a better image if they're your only option.
In general, diffusing the light is your best bet and something any camera can do. If you've got a nice big flash, you can build a DIY softbox out of a piece of paper . It doesn't really get any cheaper than that. If your flash doesn't stick out or pop up, but rather is a little LED light integrated into your camera's body, you can still diffuse with paper (or white sticker or even a spoon). All you have to do is cover the flash with paper and your flash will produce softer light. Diffusion will reduce the brightness of the light your flash produces, but this change is minimal and should only make a positive difference.
If you're using a big flash that has an adjustable head, you can point it towards the ceiling. This is very useful because it bounces the light off an empty surface and spreads it across the room. Much like diffusion, this will provide less light than if you pointed the flash at the subject directly, but if your flash's head is adjustable it's most likely bright enough to compensate. This is one of the best and simplest tricks for flash photography that doesn't require any attachments.

Keep Your Lens(es) Clean

This may seem obvious, but dust and smudges can ruin photos (or at least offer up some tedious work in Photoshop later). It's important to clean your lens(es) regularly and know how to do it properly . For the most part, you can get by with a soft cloth (microfiber is ideal) and some rubbing alcohol. Simply apply a little rubbing alcohol to the cloth and wipe your lens' glass in a circular motion. As you get to the edges, try to pull the dust off as you lift up. Check out the video to your left for some additional tips and tricks.

Android - iPhone - BlackBerry Sex Survey Recap

February 5, 2012 8:33:20 PM

Android users are more likely to have sex on first date | VentureBeat

venturebeat.com

A recent survey by Match.com has revealed Android users need lovin' a little quicker than iPhone and Blackberry users.

The survey was broken down by Match.com's "Relationship Insider" Kimberly Moffit, who revealed that 75 percent of Canadian singles believe e-mail and texting have significantly improved their dating life. "More so than zodiac signs or astrology, smart phones are the new way Canadian singles can decode their dating style and determine if they've met their match," wrote Moffit.

So, what does your smartphone say about your life love?

iPhone Users: The Office Romantic

• iPhone addicts are the most likely to date someone in their workplace. Nearly a quarter of iPhone singles have had an office romance in the last five years.
• After a first date, iPhone users wait just one day to reach out, while Android or BlackBerry users will wait until after 2-3 dates.

BlackBerry Users: The Drunk Dialer

• If you're dating a BlackBerry fan, prepare to imbibe. BlackBerry users are most likely to drink alcohol on a first date – 72 percent will have a boozy beverage on a first night out.
• A whopping 67 percent of BlackBerry users say they have experienced love at first sight.

Android Users: The Seducer

• Android users are most likely to be seduced on a first date. 62 percent of Android singles say they've done the deed after date number one, compared to 57 per cent of iPhone users and 48 percent of BlackBerry users.
• Out of all smart phone users, Android fans are most likely to have a one-night stand (55 percent).
• 72 percent of Android fans have visited an online dating site, compared to 58 percent of iPhone users and 50 percent of Blackberry users.

Post Jailbreak: How To Reset Your iPhone's root Password

How To Change the iPhone's Root Password | iSource

How To Change The iPhone 's Default Admin Account Passwords:

On a Mac:

• Find your iPhone 's IP address so that you know where you need to connect to.  To do this, go to the Settings app > WiFi > tap on the blue arrow to the right-hand side of the WiFi network you 're currently on (the one with a check next to it) > make a note of the IP Address entry listed there.
• On many home WiFi networks the address will be something like 192.168.1.x " so we 'll use that in the command instructions below " remember to use your own IP address when doing this though.
• Use the Terminal app or your favorite replacement for it (I use iTerm) and open a new window
• Type this to connect as root to your iPhone: ssh root@192.168.1.x
• You 'll be prompted for the root user 's current password.  Enter this: alpine
• Type this to start on changing the password for the root user: passwd
• Type the old password (alpine) and new password (twice) as per the instructions above for the iPhone.
• Once you have changed the root user 's password, type this to switch to the mobile user: login mobile
• Type this to start the password change for this user: passwd
• Type the old password (alpine) and new password (twice) as per the instructions above for the iPhone.
• Type this to end your remote session with the iPhone: exit

Done.
On a Windows PC

• Find your iPhone 's IP address so that you know where you need to connect to.  To do this, go to the Settings app > WiFi > tap on the blue arrow to the right-hand side of the WiFi network you 're currently on (the one with a check next to it) > make a note of the IP Address entry listed there.
• On many home WiFi networks the address will be something like 192.168.1.x " so we 'll use that in the command instructions below " remember to use your own IP address when doing this though.
• Use Putty (free to download on the web) or your preferred app to make an ssh connection to the iPhone
• Use 192.168.1.x (your iPhone 's IP address) as the host name or server name to connect to.  Choose ssh as the connection method, SFTP as the protocol, and 22 as the port number.
• Use the username root to connect with and alpine as its password
• When you have connected and have a terminal window open type this to start your password change for the root user: passwd
• Type the old password (alpine) and new password (twice) as per the instructions above for the iPhone.
• Once you have changed the root user 's password, type this to switch to the mobile user: login mobile
• Type this to start the password change for this user: passwd
• Type the old password (alpine) and new password (twice) as per the instructions above for the iPhone.
• Type this to end your remote session with the iPhone: exit
• Done.
  
  As you can see, these are easy and fast steps to take.  If you 're running your iPhone jailbroken and using the SSH service it 's very worthwhile to make these changes to the default passwords.  Even if you do not use SSH, keep in mind that other core iPhone services may have security holes and exploits in future " so the password change is a good idea all the way round.
  If you are using SSH, another good practice is to keep the service always toggled off except when you are using it for file transfers or similar activities, and to get in the habit of shutting it off as soon as you 're finished working with it.  The easiest way to do this is to use the excellent SBSettings app, to have a quick one-tap toggle on/off for SSH and other key services.

Apple's Growth Rate Is Simply Incredible... And It's Accelerating

There are plenty of impressive stats in Apple's December quarter earnings report , such as 37 million iPhones shipped, $46 billion of overall sales, and $13 billion of profit.
But Apple's most impressive stat continues to be its growth rate: Apple is not only huge, but it is growing at a rate far greater than its peers. And, even more incredible, its growth rate is accelerating .
As a company gets bigger, or as a market matures, its growth rate typically falls. It's only natural: The numbers get bigger, so the percentage of change eventually shrinks. But for Apple, during the Christmas quarter — its busiest time of the year — that hasn't happened yet.

Specifically, last quarter, Apple's overall sales totaled $46.3 billion, an increase of 73% over the previous December quarter. That's an acceleration over Apple's growth rate from the December 2010 quarter, when it posted 71% growth. And that was better than the year before, when it grew 32%. That, too, was faster than the year before, when Apple posted a 6% growth rate in the bowels of the recession. So for the third year in a row, Apple has accelerated its Christmas quarter sales growth.
Why is this so impressive? Because maintaining your growth rate when you're Apple's size — never mind increasing it — takes a lot of work!
This past Christmas, Apple needed to add an extra $20 billion in new sales to grow by 73%. The year before, it "only" needed to generate an additional $11 billion in new business to grow by 71%. It's pretty astounding, especially considering that Apple's product lineup didn't even change that much last year.
The reason it happened, of course, was the iPhone 4S "perfect storm." Not only was it a new iPhone, but it launched during what is already Apple's busiest time of the year, the holiday quarter. And it expanded Apple's footprint to new carriers, such as Sprint. Add pent-up demand to the mix, and Apple was easily able to shatter its iPhone sales record. Then consider that the iPhone is Apple's biggest business by revenue and profits, and the big numbers fall into place.
Can it happen again? It's only going to get harder. To match this year's growth — 73% — Apple's December 2012 quarter would have to beat $80 billion in sales. That's a lot of iPhones. The way the smartphone market is growing, and the way the iPad looks like it's going to do, anything's possible. But it's not going to be easy.