A malicious iOS app can gain access to image Library and get your location from the image metadata. Which leads to serious privacy issue.
Felix Krause Founder of Fastlane tools found this issue iOS permission issue last week. With this permission issue, any camera app that has access to image library can extract the user locations from the image metadata.
Krause says, there should be an alternate authorization for applications that to choose a photograph and applications that oversee or alter pictures. They’re altogether consolidated under a similar class of permission.
Additionally, use of the native image picker should be enforced by Apple, and apps that use a custom one will be rejected.
The app will not edit your photo library in any way – iOS photos permission is smart and only grants immutable access, meaning in theory, the app could add new pictures, but not edit/delete existing ones.
EXIF data which is Exchangeable image file format according to Japan Electronic Industries Development Association which specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.
Also Read Tracking Photo’s Geo-location with GPS EXIF DATA – Forensic Analysis
The Exif format has standard tags for location information. As of 2014 many cameras and most mobile phones have a built-in GPS receiver that stores the location information in the Exif header when a picture is taken.
The process of adding geographic information to a photograph is known as geotagging. Photo-sharing communities like Panoramio or Flickr equally allow their users to upload geocoded pictures or to add geolocation information online.
Specifically, an application can get the accompanying information:
Felix published PoC and steps to reproduce the issue, also he coded a DetectLocations app which shows your pictures on a map visualized.
Also, it shows pictures that were taken on transport (e.g. car, plane), so it’s easier to find them.
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…