Saturday, November 2, 2024
HomeHacksiOS Application can Extract Your Geo-Location Details From Image Metadata

iOS Application can Extract Your Geo-Location Details From Image Metadata

Published on

Malware protection

A malicious iOS app can gain access to image Library and get your location from the image metadata. Which leads to serious privacy issue.

Felix Krause Founder of Fastlane tools found this issue iOS permission issue last week. With this permission issue, any camera app that has access to image library can extract the user locations from the image metadata.

Krause says, there should be an alternate authorization for applications that to choose a photograph and applications that oversee or alter pictures. They’re altogether consolidated under a similar class of permission.

- Advertisement - SIEM as a Service

Additionally, use of the native image picker should be enforced by Apple, and apps that use a custom one will be rejected.

The app will not edit your photo library in any way – iOS photos permission is smart and only grants immutable access, meaning in theory, the app could add new pictures, but not edit/delete existing ones.

EXIF DATA – Tracking Photos- Image Metadata

EXIF data which is Exchangeable image file format according to Japan Electronic Industries Development Association which specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.

Also Read Tracking Photo’s Geo-location with GPS EXIF DATA – Forensic Analysis

The Exif format has standard tags for location information. As of 2014 many cameras and most mobile phones have a built-in GPS receiver that stores the location information in the Exif header when a picture is taken.

The process of adding geographic information to a photograph is known as geotagging. Photo-sharing communities like Panoramio or Flickr equally allow their users to upload geocoded pictures or to add geolocation information online.

  • Get a past filled with the urban areas, nations, and different spots a client has gone to, as long as they took a photo there
  • Get an entire rundown of the client’s cameras and photography gadgets (which iPhones, Android telephones, cameras) and to what extent they utilized every gadget
  • Discover the client’s work environment, by making sense of where they are from 9 to 5
  • Utilize facial recognization to discover who the client hangs out with and who their accomplice is. Is the client single?

Specifically, an application can get the accompanying information:

  • The correct area of every benefit
  • The physical speed in which the photo/video was taken (how quick did the camera move)
  • The camera shows the correct date + time and other EXIF picture metadata

PoC Code and Demo App by Felix Krause

Felix published PoC and steps to reproduce the issue, also he coded a DetectLocations app which shows your pictures on a map visualized.

Also, it shows pictures that were taken on transport (e.g. car, plane), so it’s easier to find them.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Telegram Bot Selling Phishing Tools to Bypass 2FA & Hack Microsoft 365 Accounts

A newly discovered phishing marketplace, ONNX Store, empowers cybercriminals to launch sophisticated attacks against...

Mobile Device Management Vendor Mobile Guardian Hacked

 Mobile Guardian, a leading Mobile Device Management (MDM) vendor, experienced unauthorized access to its...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...