6

This statement in the iOS 7 release notes implies that non-China devices do not need user consent:

iOS now requests user consent for apps to use audio input on all iOS 7 devices. For devices sold in China, iOS will also request user consent for apps to use the camera hardware. iOS SDK Release Notes for iOS 7 GM

Is there any protection against an app accessing either camera without the user's knowledge and/or consent?

This is a follow-up question to the comment on device fingerprinting (and other iOS privacy vulnerabilities) here: What unique fingerprinting information can an iOS7 app collect?

1

As of iOS 8, apps do need to request access to the cameras. When an app on iOS 8 attempts to access a camera, it shows a system alert and requests the user to accept the access before the app is allowed. Denying the access will prohibit the app from accessing the camera.

For iOS 7 in your question, yes, an app can access either camera without requesting the user's permission (except in China as you found out). All apps have unrestricted access to view the camera feed of either the front-facing or rear-facing camera and take pictures/videos.

However, access to the Camera Roll to save such media does require the user's consent. Most apps on the App Store request access to photos immediately so as to not interrupt the user whilst they take their first picture, however this is simply to gain access to the general location for saving the media, not for accessing the camera itself. Apps are fully able to capture pictures and video from either camera at will without requesting permission providing it saves the media within the app's sandbox.

  • Do I understand correctly then that any (active) 3rd-party app could potentially take still photos or videos surreptitiously, and phone them home to a server on the internet, with no indication whatsoever to the user? – pseudon Apr 12 '14 at 20:58
  • @pseudon Exactly, providing the media is kept within the sandbox. – grg Apr 12 '14 at 20:58
  • Thanks. Scary, and hopefully this vulnerability is closed by Apple soon. – pseudon Apr 12 '14 at 21:00
  • @pseudon Updated answer! iOS 8 beta does show a request alert for camera access – grg Jun 17 '14 at 8:42
  • George, thanks, I noticed the "worldwide" reference in the WWDC privacy session slides devstreaming.apple.com/videos/wwdc/2014/715xx4loqo5can9/715/… A welcome change! – pseudon Jun 18 '14 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.