iPhone Security News: Apple Reportedly Allowed Uber to Secretly Record Users' Screens
A recent report claims that Apple allegedly allowed Uber to implement a code on its application that would let it secretly capture screenshots from a user's device. The ride-hailing company confirmed the existence of the API but clarified that it was not actively being used. They also promised to work with Apple to immediately drop the screen-capturing feature.
Security analysts shared the information through Gizmodo and explained that it was a measure the companies deemed was needed to "improve functionality" for Uber users who have their iPhones paired with their Apple Watches.
The report also described the discrete feature as a "powerful tool" since it can take screenshots even if Uber was just operating in the background.
Get Our Latest News for FREE
In particular, the screen-capturing code was reportedly applied so Uber users with an Apple Watch can optimize the memory of their smartwatch. However, it does not take away the fact that the feature is rare compared to other "entitlements" that Apple permits third-party app developers to have for programs installed on Apple platforms.
Sudo Security Group CEO Will Strafach told Gizmodo: "It looks like no other third-party developer has been able to get Apple to grant them a private sensitive entitlement of this nature."
This raised the curiosity of some security experts considering that there were earlier reports on how Uber treated their end users' privacy. It can be recalled that in April, an exclusive report from the New York Times revealed that Apple CEO Tim Cook previously held a private meeting with then Uber CEO Travis Kalanick.
Cook purportedly confronted Kalanick after the latter's company was found breaching Apple's privacy policies that allowed Uber to continue tracking iPhones even after the users have uninstalled the Uber app.
Meanwhile, Uber confirmed that they have taken down the screen-capturing feature through a recently released patch. The company also said in a statement: "You should know this API isn't connected to anything in our current codebase, meaning it's non-functional and there's no existing feature using it."
