2

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than the system's default.

Android has had this feature for quite some time. On Android, those keyboards are known as a possible security threat, most notably by acting as a keylogger.

Does iOS 8 prevent such malicious behaviour from happening? If so, what security mechanisms are in place?

  • The actual keylogger scenario is impossible to prevent -- that's the whole point of building a trusted path between the user and OS for input handling. See discussions on Linux Wayland security to understand why this matters. This being said iOS can leverage on specific characteristics of its UI to limit the risks associated with custom keyboard apps. – Steve Dodier-Lazaro May 10 '15 at 14:23
1

There is also a safety feature built into the system itself, that prevents third-party keyboards to type into password fields - when you touch a password field the system will go back to the default keyboard temporarily.

By the way, I wouldn't trust Apple to verify that apps aren't malicious. A lot of apps use libraries provided by analytic providers, and while analytics by themselves are spyware, some of them are careless enough to transmit sensitive data (location, name, email) over plain HTTP and yet be accepted just fine in the App Store.

1

Yes, these apps could record what you're typing, or generate arbitrary input events in your stead. There is hardly a thing you can do to prevent input-providing processes from abusing their privileges.

This being said, there are some structural factors about how input is handled on mobile UIs that limit the risks of custom keyboards (as opposed to desktops):

  • Keyboard input is only used for in-app input, and not for interacting with the system's UI, switching between apps or launching apps: this makes some attacks impossible such as opening a terminal/app, typing in custom stuff and closing the app behind
  • Keyboard input apps probably don't require an internet connection or statefulness beyond an API imposed by the OS, making it harder for them to act maliciously. There could still be apps that legitimately use an Internet connection (e.g. sync'ing your custom words across devices) or IPC (reading your emails to predict words you use often). As such, the best way to handle custom input providers is to give them a specific permission to handle input rather than run them unsandboxed. That is what iOS does apparently.
  • According to Andre (I didn't check myself :-) ), password input fields are always managed by your native keyboard. Whether that's always a good thing is up for debate -- for instance, mobile users choose notoriously weaker passwords in order to reduce the number of mode changes they need to perform when typing a password, and keyboards with better or more customisable handling of special characters could be used to type stronger passwords on mobile UIs with little extra cost.
0

I believe the answer is quite simple unlike android, apple does not have multiple app stores and the official app store has relatively strict policies regarding app verification

in other words, even though iOS 8 allows custom keyboards, they still need to be verified before they are put up on the app store. however this is not the case for unofficial app stores and jail-broken device are (as always) at a risk

app/plugin verification aside, in a relatively closed operating system like iOS, it is not so difficult to deny apps/plugins internet access, therefore rendering a keylogger mainly useless.

  • That seems really unlikely. – Graham Hill Jun 11 '14 at 10:55
  • a similar mechanism is already being used in the app store so I don't understand why will it be unlikely? – Abbas Javan Jafari Jun 13 '14 at 2:33
  • Sorry, I mean it seems really unlikely that the only steps they take are app store review. If that were enough, Apple wouldn't have waited this long. Much more likely is that the new keyboards leverage the new app extensions infrastructure. – Graham Hill Jun 13 '14 at 11:38
  • Aha! so that's what you meant, I totally agree! I wasn't specifically talking about app reviews but more so about the general concept in which apple does not simply allow developers to release apps/extensions whenever and however they want :) – Abbas Javan Jafari Jun 13 '14 at 16:16
  • At the current time we cannot be certain of the actual technical mechanisms in place, but we can speculate based on the company's history and general policies. – Abbas Javan Jafari Jun 13 '14 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.