Apple security problem! Patch your systems urgently

[Psamathe]

A phonebook/contacts data is "private data" surely?
Photos, voice messages etc etc

Take a browse through all the installed apps and see how much data they hang on to.
Then of course if you use it for interwebs there's probably tons of other stuff too.

The question probably need rephrasing as "who doesn't have private data on a mobile phone"...
(Yes, we all know who that person is. ;) )

Contacts list?
Names and telephone numbers. How do you know that the other people on the list keep it "private"? If you want to look at my contacts list, help yourself.

Photos?
Just about every one I've taken with my phone - and my digital camera - are on here for public viewing. Others are saved on external drives and wiped off my phone.

Rarely use my phone for the internet. Too small a screen to be of any use.
Never use email on it as I don't have an email account on the phone.

I have an old iPhone5c which knocks spots off my iPhone6s but it's no longer supported. I sometimes swap my sim over to use the 5c as it fits in a pocket far easier.

Contacts lists often include phone numbers and e-mail addresses which is useful information when trying to gain access to online accounts. Who has who as contacts is very valuable (look at how far Facebook/WhatsApp go to get their hands on that data). Photos you take likely have geolocation included.

Scammers love lists of phone numbers to e.g. call about "the accident you have and need to make a claim about". Many people will include birthdays (so they get reminders about sending cards) and that gives away and age which helps Scammers target people with pension pots.

And even if your phone does not have a lot of info, other people's phones probably have useful information about you - so it's not only about what you have on your phone.

Ian

[Jdsk]

A phonebook/contacts data is "private data" surely?
Photos, voice messages etc etc

Take a browse through all the installed apps and see how much data they hang on to.
Then of course if you use it for interwebs there's probably tons of other stuff too.

The question probably need rephrasing as "who doesn't have private data on a mobile phone"...
(Yes, we all know who that person is. )

Contacts list?
Names and telephone numbers. How do you know that the other people on the list keep it "private"? If you want to look at my contacts list, help yourself.

Photos?
Just about every one I've taken with my phone - and my digital camera - are on here for public viewing. Others are saved on external drives and wiped off my phone.

Rarely use my phone for the internet. Too small a screen to be of any use.
Never use email on it as I don't have an email account on the phone.

I have an old iPhone5c which knocks spots off my iPhone6s but it's no longer supported. I sometimes swap my sim over to use the 5c as it fits in a pocket far easier.

Do you have an AppleID on the 'phone?

Thanks

Jonathan

[Mick F]

Yes.
It's the only way to get updates.
They need a password though, and that's not held on the phone as Apple don't allow for it.

[Jdsk]

Who has "private data" on a mobile phone?

What's your AppleID and passcode for that 'phone please?

Jonathan

[Mick F]

The Apple ID is pointless without the password.
My phone isn't locked with a passcode.

There's nothing on my phone of any interest.

[Jdsk]

Who has "private data" on a mobile phone?

What's your AppleID and password please?

Jonathan

[Mick F]

Why would I tell you that?

My Apple ID password is in my brain's memory. Not written down anywhere. Mrs Mick F has difficulty remembering her ID so I have to remember it for her.

[Jdsk]

Because you clearly have private data on your 'phone... your AppleID and your passcode.

And I expect a lot more... how about posting a screen dump of your recent 'phone calls and messages?

Jonathan

[simonineaston]

Given that Apple bake interoperability and data-sharing (as in "your digital life" etc. etc.) across all devices into their products, I dare swear that access to an iPhone reveals more about an individual than perhaps they might expect... It is a switched-on and persistant iUser indeed who will manage to turn off all the Apple-based services that talk to each other, either obviously, eg Photos using iCloud, or else behind-the-scenes...

[Jdsk]

Given that Apple bake interoperability and data-sharing (as in "your digital life" etc. etc.) across all devices into their products, I dare swear that access to an iPhone reveals more about an individual than perhaps they might expect... It is a switched-on and persistant iUser indeed who will manage to turn off all the Apple-based services that talk to each other, either obviously, eg Photos using iCloud, or else behind-the-scenes...

Yes. And on all relevant devices the same applies to eg 'net accounts and 'phone accounts. Those suppliers are often taken for granted and forgotten.

Jonathan

PS: I've been involved in many identity and confidentiality projects and one national campaign. "I have nothing to hide" comes up time and time again. AFAICR no-one has ever responded to the obvious challenge to publish what they do have by publishing it.

[mjr]

[...] It's serious enough to need a "single bug" patch, which has been released for all iOS devices dating back to 2013!

That's not a level of support you get with any other phone vendor or mobile os...

Well, the mobile os I'm using at seems to have been updated regularly since 2007, so I don't think that's true.

If you mean devices not os, several Android devices from 2013 are still getting updates, including the Google Nexus 7, LG G2 and Samsung Galaxy S4.

Credit to Apple for fixing their "brown paper bag" bug quickly, but it's no more than we should expect.

[simonineaston]

...my current worry is about those third-party agents. Let's pretend I bought a tool for my bike a couple of years ago. I visited the supplier's website and found the exact tool I was having trouble locating. In my excitement, I made a one-off payement with my card credentials, instead of using my preferred method, PayPal for example. My card details are now held by a trader who I know little about and will probably never visit again. A door-way to my financial arrangments is now in the hands of a complete unknown.
Now consider that I may have carried out this sort of transaction not once but several times over the years - and furthermore, have forgotten all about them, they being small, one-off purchases, and I'm starting to wonder exactly how secure my bank account is!! I read that bank account fraud is very very common, so it appears my anxiety is well-founded. I wonder if it's worth setting up a dedicated bank account with limited funds, just for online shopping, as a precaution.

[Psamathe]

...my current worry is about those third-party agents. Let's pretend I bought a tool for my bike a couple of years ago. I visited the supplier's website and found the exact tool I was having trouble locating. In my excitement, I made a one-off payement with my card credentials, instead of using my preferred method, PayPal for example. My card details are now held by a trader who I know little about and will probably never visit again. A door-way to my financial arrangments is now in the hands of a complete unknown.
Now consider that I may have carried out this sort of transaction not once but several times over the years - and furthermore, have forgotten all about them, they being small, one-off purchases, and I'm starting to wonder exactly how secure my bank account is!! I read that bank account fraud is very very common, so it appears my anxiety is well-founded. I wonder if it's worth setting up a dedicated bank account with limited funds, just for online shopping, as a precaution.

I think it's far worse than that. How many people happily give details to Dido Hardling - despite a proven track record of failing to keep that personal details from "the bad guys". How many people then download her phone app ...?

Ian

[Jdsk]

...my current worry is about those third-party agents.

Greater general awareness of the risks would be a good idea. Discussion is excellent.

At the moment I'm more concerned about government, Facebook and Google than banks.

Jonathan

[PDQ Mobile]

But for many of us this constant need to "keep up man" is an unwelcome pressure, and a feeling of being in some sort of exploiting mouse-wheel that serves only to waste time spent on other more enjoyable and fulfilling pastimes.

A sort of never ending catch up, imposed by ever more (unwelcome?) sophistication of both software and it's users and peddlers, both legal and shady.

Mickf, wisely in my view, keeps no private info of worth on his iphone.
He cares little if his record of phoning a family member at a certain time is known by someone else.
Indeed that particular record, and that of his browsing history, is available to the digitally competent anyway- though his provider(s).

The weakness in security that is trying to be fixed here, is AFAIUI, based upon "cookies".
I only accept cookies when I so choose and from trusted sites.
(To top up using a voucher for example.)
And I always delete them straightaway.

In another thread I was thoroughly mocked for this approach.
But I suffer virtually no spam, funny phone calls etc.

Indeed my old iphone 4 continues to function in it's NEVER updated form (IOS7!) surprisingly well for my simple needs.
It now functions less well on some sites if I DO accept cookies!

And it's memory is used for what I want to store, (mostly pics and music) not on some bloated operating system, that perversely, in it's ever increasing complexity, allows ever more security "issues" and needs updating ever more frequently.
Catch 22 pure!

There are great and undervalued benefits to simplicity.
In many areas of life.

That sentiment particularly apt on a cycling forum.
Though even the humble bicycle is now ever more complex and hard to repair with normal tools- for little if any benefit that I can see.

There is a certain freedom in simplicity.
And in poverty!