iPhone apps can silently turn on your front or back camera

Cyber criminals can use iPhone apps to secretly turn on your front or back camera at any time, a security expert has warned.

Google engineer Felix Krause was able to build an app that silently takes a picture of its user every second and then uploads them to the internet.

He said the issues is a ‘privacy loophole that can be abused by iOS apps’.

The only safe way to protect yourself from the hack is using camera covers, which can be bought online, though a simple sticky note will suffice.

You can also revoke camera access for all apps and always use the built-in camera app to avoid being caught out.

Cyber criminals can use iPhone apps to secretly turn on your front or back camera at any time, a security expert has warned. An engineer was able to build an app that silently takes a picture of its user every second and then secretly uploads them to the internet (stock image)

HOW IT WORKS

An expert has shown that when an app has permission to access the camera, once opened it can take photos and videos of the user at any time.

The iPhone gives no indication that the camera is being used or that the photos are being uploaded to the internet.

The only safe way to protect yourself is using camera covers, which can be bought online.

A simple sticky note or piece of blu-tac will also work.

You can also revoke camera access for all apps and always use the built-in camera app to protect yourself.

When an app wants to access your camera, for instance to take a profile photo during set-up, it must first ask for permission.

Once granted, this permission can only be revoked via the settings menu.

Mr Krausse, based in Vienna, Austria, said that once an app is opened, it can take photos and video of the user via either camera at any time.

The iPhone gives no indication that the camera is being used or that the photos are being uploaded to the internet.

‘iOS users often grant camera access to an app soon after they download it (e.g., to add an avatar or send a photo),’ he wrote in a blog post.

‘These apps, like a messaging app or any news-feed-based app, can easily track the users face, take pictures, or live stream the front and back camera, without the user’s consent.’

In Apple’s latest operating system, iOS11, permission to access your camera means apps can use the software’s facial recognition system.

This means that malicious apps could be used to secretly detect the emotions of users.

The loophole found by Mr Krause is not a bug but simply takes advantage of the way Apple has set up its permission system.

Google engineer Felix Krause uploaded this video to YouTube to demonstrate how an app he built could secretly take pictures of iPhone users every second and upload them to the internet

Mr Krause demonstrated this by building a malicious app that took a photo of its user every second and also tapped into a facial recognition programme.

He said other apps could live stream video of users, read their emotions as they scroll through a social network feed, or record what they are saying.

Mr Krausse said Apple should bring in a system of temporary permissions to stop any malicious apps meddling with users’ cameras.

These permissions would involve allowing apps to take a picture during the set-up process but taking it away after a short period of time.

The other option would be for Apple to introduce a warning light that lets people know when they are being recorded.

When an app wants to access your camera, for instance to take a profile photo during set-up, it must first ask for permission. But once an app is opened, it can take photos and video of the user via either camera at any time, which cyber criminals could use to their advantage (stock)

The Austrian engineer offered a few solutions for those wishing to protect themselves from the loophole.

‘The only real safe way to protect yourself is using camera covers: There is many different covers available, find one that looks nice for you, or use a sticky note (for example),’ he wrote.

‘You can revoke camera access for all apps, always use the built-in camera app, and use the image picker of each app to select the photo.’

There are few examples of apps being specifically designed to spy on users, but Mr Krausse said it would be easy to hide this behaviour, allowing it to get through Apple’s app approval process.

The Austrian engineer works at Google but has said his security research is a hobby and is in no way affiliated to his employers.

FIVE STEPS TO MORE SECURE ONLINE OPERATIONS

Even using this checklist can’t guarantee stopping every attack or preventing every breach. But following these steps will make it significantly harder for hackers to succeed.

1) Enable two-factor authentication (2FA). Most major online services, from Amazon to Apple, today support 2FA.

When it’s set up, the system asks for a login and password just like usual – but then sends a unique numeric code to another device, using text message, email or a specialized app.

Without access to that other device, the login is refused. That makes it much harder to hack into someone’s account – but users have to enable it themselves.

2) Encrypt your internet traffic. A virtual private network (VPN) service encrypts digital communications, making it hard for hackers to intercept them.

Everyone should subscribe to a VPN service, some of which are free, and use it whenever connecting a device to a public or unknown Wi-Fi network.

3) Tighten up your password security. This is easier than it sounds, and the danger is real: Hackers often steal a login and password from one site and try to use it on others.

To make it simple to generate – and remember – long, strong and unique passwords, subscribe to a reputable password manager that suggests strong passwords and stores them in an encrypted file on your own computer.

4) Monitor your devices’ behind-the-scenes activities. Many computer programs and mobile apps keep running even when they are not actively in use.

Most computers, phones and tablets have a built-in activity monitor that lets users see the device’s memory use and network traffic in real time.

You can see which apps are sending and receiving internet data, for example. If you see something happening that shouldn’t be, the activity monitor will also let you close the offending program completely.

5) Never open hyperlinks or attachments in any emails that are suspicious.

Even when they appear to come from a friend or coworker, use extreme caution – their email address might have been compromised by someone trying to attack you.

When in doubt, call the person or company directly to check first – and do so using an official number, never the phone number listed in the email.

– Arun Vishwanath, Associate Professor of Communication, University at Buffalo, State University of New York

Read more at DailyMail.co.uk