SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

https://rambo.codes/posts/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop

by mnem • 4 years ago

551 206 4 years ago

rambo.codes

jdelman• 4 years ago

$7k feels like a paltry sum for this discovery. Rambo is doing yeoman's work.

QuackyTheDuck• 4 years ago

Sigh … I so much want Apple to get their shit together. To me it feels like software quality reached a new low.

gw992• 4 years ago

The scary thing is it's the least bad option when it comes to overall reliability.

gtvwill2• 4 years ago

Ooo that's a big depends on the situation. Making only phone calls. Sure iPhones are great. Running LOB apps. Lol have fun passing that crap through apples store. Androids way easier for LOB.

Remote MDM? Lol nightmare using apples gear. Warranty services? Also a nightmare. Fleet level warranty support? Ahahhahhaha have fun paying folks like IBM out the kazoo. No thanks.

iPhones are rock solid if you played w Fischer price toys as a kid and only ever plan to be on the public consumer end of the game, making calls and using apps someone else has decided are ok for you. Go up the line to fleet rollout or bulk purchasing/warranty work or running custom line of business apps. Ahahhahhaha have fun w apple I've done the work when I was w/ ibm, I refuse to touch it these days.

codalan• 4 years ago

I think it depends on the phone.

The Google Pixel series seems pretty solid for reliability. I have a Pixel 7 Pro and it's been really good so far in terms of software and build quality. I strongly prefer it to my iPhone 13 Pro, which I'm currently selling off.

But iPhone vs Samsung Galaxy? iPhone wins by a mile. I never got used to the custom interface Samsung loaded onto those phones, and hated that it included Samsung-specific apps that just duplicated those already available by default on stock Android.

freeplay2• 4 years ago

Couldn't agree more. As stupid as it may be, the only reason I haven't moved to Andoid/GrapheneOS is iMessage.

alphabetting3• 4 years ago

that's the main reason for most iphone users i know and exactly why Apple will stall for as long as possible on RCS compatibility

z9znz6• 4 years ago

There were some stubborn bad decisions that Steve Jobs stuck to (1 button mouse, windows that don't appear when you cmd-tab to them), but his Apple seemed to have better software. Since him, it really seems to have gone downhill in terms of bugs and UI consistency.

mikece• 4 years ago

I don't want stories like this to be the reason I'm glad I switched to Graphene OS. I don't want anyone hacked or spied on.

aaronharnly• 4 years ago

Pro tip: all systems have bugs.

NayamAmarshe• 4 years ago

Not all systems come with easy eavesdropping mechanisms. Especially the ones focused on Privacy.

devX32• 4 years ago

Kinda funny that you have to buy/support hardware from a company but then need to use a opensoure nonprofit OS to protect yourself against said hardware producer.

henriquez• 4 years ago

Seems like $70,000 would have been a more fair bounty. This is a really nasty bug.

pvg7• 4 years ago

$70,000 would have been more fair

There's really no basis for this beyond its reflexive repetition on messageboards. You might as well type 'million dollar logout CSRF' in every vulnerability report thread.

lapcat3• 4 years ago

Here are the listed payouts from the Apple Security Bounty program, starting at $25,000. https://developer.apple.com/security-bounty/payouts/

dangerwill• 4 years ago

It is definitely arbitrary but part of me does think that surfacing such a bug is pretty important and if the monetary incentive was higher then we would have more white hat pentesters out there.

_hhkc• 4 years ago

"iOS bug allowed apps to eavesdrop on your conversations with Siri" should be "iOS bug allowed apps to eavesdrop on your interactions with Siri and dictation over bluetooth"

freeplay2• 4 years ago

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.

cstejerean• 4 years ago

Even worse, it looks like on MacOS you can just straight up start recording on-demand, no need for dictation or siri.

Even worse, this particular exploit would also allow the app to request DoAP audio on-demand, bypassing the need to wait for the user to talk to Siri or use dictation.

SamuelAdams2• 4 years ago

And this is why I have the internal microphone disconnected on my macbook pro. The only time a mike is attached is when I'm actively using it, and even then they have hardware kill switches.

Simple kill switches would be nice to see but I doubt Apple would ever implement something like that.

dontbenebby3• 4 years ago

I think they burried the lede here. Conversations with Siri are probably pretty generic but being able to evesdrop on keyboard dictation is pretty severe. I know people that use dictation for the majority of their text messages and email.

I agree with your take!!

If you scroll to the "Full TCC Bypass on macOS" portion, you can see that this bug allows folks to turn on an Airpod and direct that audio to a macOS device. This could enable what is known as a Tempest Attack[0,1]

BTLEServerAgent did not have any entitlement checks or TCC prompts in place for its com.apple.BTLEAudioController.xpc service, so any process on the system could connect to it, send requests, and receive audio frames from AirPods. This exploit would only work on macOS, because the more restricted sandbox of iOS prevents apps from accessing most global mach services directly.

Stuff like that are why I hate Bluetooth in general, and I'm on the fence if either my laptop OR phone will be Apple products when I replace them.

(They seem to cater to people who replace their devices every year and camp out outside the Apple store for new Apple stuff like nerds rather than the folks who didn't want to spend every weekend messing with kernel drivers and thus adopted what I will continue to refer to as "shiny BSD" even though they long since changed the name from OSX to macOS.)

-- [0] https://en.wikipedia.org/wiki/Tempest_(codename)#Public_rese... [1] http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzw[...

aquajet• 4 years ago

How many people use diction? I'm surprised cause I know virtually no one who uses diction, myself included.

ok_dad• 4 years ago

My mother does it because of arthritis. Constantly.

willis936• 4 years ago

I don't for multiple reasons, not the least of which is the possibility of an exploit that leaks it. I don't trust software.

throwaway2903• 4 years ago

I use dictation a lot, I hate typing on touchscreens and hate voice messages.

jdwithit2• 4 years ago

My father in law (mid 70s) uses it constantly to compose text messages. I'm not sure I've ever seen him type one.

JustSomeNobody• 4 years ago

I use it when I want to send a text message that's longer than a few words. As long as I can do that without being a jerk to those around me.

crazygringo3• 4 years ago

I use it constantly for brainstorming ideas and thinking out loud. Very rough first drafts of essays, stuff like that.

Basically whenever I just want to get my thoughts out and I'll be the only person reading it, so I don't worry about typos because I can always figure out what I meant.

It's a godsend in terms of speed. I type fast but my brain still goes faster. But I definitely speak faster than I can think.

It only works privately in an office or at home though, obviously. Not helpful on the subway.

dmd• 4 years ago

Me, all day pretty much.

girvo3• 4 years ago

My partner uses it constantly while driving. It's illegal to use a phone while driving, and we have cameras everywhere that will catch you if you have it in your hand and smack you with a near $500 fine and points on your license. So dictation is extremely common.

code_duck• 4 years ago

To throw in my anecdote: very frequently. I've been using it since I first saw it as an option in 2013. Only on my phone, never on my laptop.

girvo3• 4 years ago

I know people that use dictation for the majority of their text messages and email.

Yeah, I'm one of them. The iOS keyboard has slowly become so bad that it's easier to dictate instead, and my partner does the same while driving via CarPlay. This is horrible to read about.

wingerlang• 4 years ago

I recently saw a conversation somewhere about this, people said turning off swipe-typing made a significant difference in the keyboard experience. Haven't tested it myself as I use swipe, and have no issues. But might be worth a try.

walterbell17• 4 years ago

If an iOS app did not have "Background App Refresh" permission, could it still have exploited this vulnerability?

Can physical microphones be removed from Apple devices by a repair shop, while still allowing use of wired/wireless headsets?

We need Purism-style hardware kill switches for microphones, cameras and radios.

MBCook• 4 years ago

Note this Bluetooth only.

walterbell17• 4 years ago

Yes, the question is how to permanently restrict the attack surface / time windows for audio and video surveillance attacks.

SamuelAdams2• 4 years ago

Can physical microphones be removed from Apple devices by a repair shop, while still allowing use of wired/wireless headsets?

Yes, this is what I do. The mike is actually still in the laptop but it's disconnected from the motherboard. On a 2021 M1 Macbook pro all you need to do is pop off the back cover and disconnect one cable on the right side of the motherboard. All in all takes about 10 minutes of work.

walterbell17• 4 years ago

Excellent, thanks for the field report.

hoorible2• 4 years ago

There actually is a physical microphone disconnect for new Mac laptops (~2019 and later). When the clamshell is closed, the mic’s connection to the MLB is physically severed.

I actually just learned this exists on new iPad models too, with any MFi-compliant case!

I know this isn’t strictly relevant, since the vulnerability discussed here is during active use, just thought you might find it interesting.

https://support.apple.com/en-ca/guide/security/secbbd20b00b/...

javajosh2• 4 years ago

It's a good idea, but I can imagine how frustrating it would be if someone called and I didn't have my headset. The EV of avoiding that experience seems slightly higher than the EV of avoiding risk of being eavesdropped on by a wayward smartphone process by disabling the internal mic.

cosentiyes• 4 years ago

We need Purism-style hardware kill switches for microphones, cameras and radios.

And accelerometers and ...

fsflover3• 4 years ago

https://puri.sm/posts/lockdown-mode-on-the-librem-5-beyond-h...

LaputanMachine• 4 years ago

Can physical microphones be removed from Apple devices by a repair shop, while still allowing use of wired/wireless headsets?

There have been reports that the 2020 iPhone SE cannot be used without a microphone:

https://repair.wiki/w/IPhone_SE_(2020)

hazyc• 4 years ago

Is anyone else an avid iPhone user, yet also someone who never uses Siri? I've used an iPhone exclusively for the past 8 years, and I can count on one hand the number of times I've used Siri. Interestingly, the one person I know who loves using Siri is my 70yr old dad.

zippergz• 4 years ago

Yes, I have had iPhones from the beginning and I never use Siri.

BudaDude2• 4 years ago

I use Siri for setting timers and reminders. It's pretty good at parsing numbers. Other than that, It hasn't been very reliable for me. Apple really needs to overhaul Siri's intelligence.

trap_goes_hot• 4 years ago

I use it for things like 'will it rain today' or sending quick texts when I am driving.

dfee• 4 years ago

I use Siri all the time and am half your dads age.

“Get directions to the nearest gas station.”, “What’s the score of the Giant’s game?”, “Play Master of Puppets”, “What is 4’3” in centimeters?” And many, many more.

Firmwarrior2• 4 years ago

Man, I used to love using Siri, until I had a daughter and named her "Sarah"

big mistake. Turns out I say "Hey Sarah" a hundred times a day, and all my iDevices pipe up and simultaneously say "Yeah?" "WHAT'S UP" "HEY OVER HERE" "Hi it's me Siri what do you need?"

parker_mountain• 4 years ago

I use it pretty frequently, mostly to set timers, alarms, or send quick texts without getting up.

SigmundA• 4 years ago

I was that way for a long time, but the Apple TV remote got me using it and I now occasionally do use it on my iPhone, mainly while driving to play music on reply to texts. Definitely has come a long way and is useful, one of my friends never types texts anymore and just dictates through Siri.

kitsunesoba• 4 years ago

My personal use as someone his 30s is mostly as a kitchen timer with a HomePod mini (not my phone), to turn on/off lights, and to occasionally toss things onto a to-do list.

My dad on the other hand loves his full size HomePod stereo pair and uses them frequently, almost entirely for playing music with voice commands. I think there are other things he might find it useful for but I haven't shown him those yet.

dilap• 4 years ago

Occasionally I ask her (it?) to set a timer or add a reminder, but mostly I don't. Siri is quite slow and frustratingly limited.

The other day in a hurry and driving somewhere, I ended up w/ both Apple Maps and Google Maps open, simultaneously giving me directions.

"Hey Siri, close Google Maps"

"To close an application, swipe up from the bottom of the phone..."

To paraphrase a quote from Steve Jobs, if your voice assistant asks you to touch the screen, you blew it.

pftburger• 4 years ago

Seconded. I get way too many "Im sorry Dave, I just can't do that" moments

Kye4• 4 years ago

Siri's performance and quality seems to depend a lot on the on-board ML cores since it switched to on-device. It was basically unusable on my 6S Plus with its early ML cores, and now it's great on the 14 Pro Max I replaced it with. It seems like they ship a Siri to match the device capability.

BudaDude2• 4 years ago

It makes no sense that Siri is so stunted in what she can do.

ThePowerOfFuet• 4 years ago

To paraphrase a quote from Steve Jobs, if your voice assistant asks you to touch the screen, you blew it.

Gold.

dcdc123• 4 years ago

The only reason I even have it enabled is because it is required for voicemail transcription.

madrox• 4 years ago

In my experiences working on voice OS, it's boom or bust depending on the user. Some people use it rarely if ever and some people live by it, and there's little in between. I think it makes sense in most cases to view voice commands as an accessibility feature.

nanidin2• 4 years ago

Siri killer apps for me are asking for factoids via my watch, and opening my garage door as I approach while driving (my building uses an app that requires multiple taps + swipes to open the garage door, using Siri makes it palatable.)

gleenn• 4 years ago

Are you using proprietary garage door software? Would live to have any better kind of integration there so any setup details that aren't crazy specific to some manufacturer would be interesting

TheFreim• 4 years ago

I know who loves using Siri is my 70yr old dad.

My mother loves using Siri, she always uses it when she wants to look things up. It seems quite useful for people who aren't proficient at typing quickly, easier to ask Siri.

Ntrails• 4 years ago

I disabled it all the day it came out.

I briefly enabled so I could text mum to say when I was nearly home. Avoids sneaking a traffic light text. Turns out it was waaaaaaaay more distracting and time consuming to get siri to text a single word, so back into the box it went

aparks517• 4 years ago

For sure. I stood in line for the original iPhone, owned every model (except the 5C) up through the 6, then an SE, X, and now an 11 Pro since it came out. I played around with Siri when it debuted, but didn't use it much. I turned it off at some point (I think it was when Apple was catching grief for keeping recordings or something like that) and haven't missed it. I'm not against it especially -- it just never really became part of my life.

z9znz6• 4 years ago

My colleagues and I had a moment of fun somewhere in remote Iceland, offroading on the way to a glacier. On an iPhone 3G, we were able to ask trivia questions and get pretty useful responses.

Aside from setting a timer, I've not seen Siri do anything more useful in 9 years. You haven't missed anything.

lagrange77• 4 years ago

The first day i asked her for the weather, songs and alarms. The second day i turing tested her, asked it philosophical questions and insulted it the worst way. Yes, that was pretty much it.

z9znz6• 4 years ago

Ironically, she will complain if you cuss at her and call her names, but she won't turn herself off. And when she pops up without my request, and I want her to go off, it seems there's no verbal way to make her go away... even verbally abusing her.

tristor• 4 years ago

You are not alone. I've been using an iPhone for over a decade now. I've had Siri turned off the entire time. I have never turned it on. I do not now, or ever, want a "voice assistant" or any technology that listens to me and tries to understand what I want by listening to me. I want technology that does exactly what I tell it to do and nothing more.

Siri is a better option than the alternative "voice assistants" on the market, but they're all bad in my book, and I don't want any of them.

joshstrange• 4 years ago

My trust of what Siri is capable of is laughably low but I do use it for reminders ("Remind me on X day...", "Remind me in X hours...", "Remind me when I get home...") and for timers. Occasionally I'll use it for unit conversions but I usually use Alexa for that since I'm in my kitchen often when I use that and it's just right there. Other than that I don't use it.

asadlionpk• 4 years ago

I just use it in text-mode ie. Double tap siri button, type the thing I want (wake me 7am). Done.

z9znz6• 4 years ago

I use Siri to set a timer. That's it. And I do it by holding my power button to activate her.

My only other use of Siri usually involved phrases like "stop", "go away", "close", "fucking close!", "you stupid fcking * ** close the **** thing" when Siri would pop up out of nowhere and interrupt whatever I was actually doing. I had it turned off, but occasionally somehow it's back on, listening.

Other actual attempts at using it have been no better than 50% effective, so it wasn't worth the trouble. And I was speaking very clearly and articulately.

I've observed a friend (a Googler who had Google-fied his house) have frequent useless conversations with the Google assistant, so maybe 50% is the best you can hope for. No experience with Alexa, but I'd be too scared to even turn it on; I might end up with three refrigerators delivered the next day.

jdwithit2• 4 years ago

Same here. Even that simple task (setting a timer) only has about a 75% success rate for me. The other 25% it spins for 30 seconds then says "hmm something went wrong". Trying for anything more complex, even playing a song or album, is just asking for trouble. I honestly can't believe how bad Siri is despite years of development.

I do have an older iPhone 10 and maybe it's just not up to the task of running Siri? But if so they should disable it rather than put on this extremely amateur feeling show.

For what it's worth we have an Echo Dot in the house and I find it to be both orders of magnitude more responsive and more likely to actually do what I asked for. No unwanted refrigerators have arrived as of yet.

ASalazarMX4• 4 years ago

My only usage of it is as a push-button dictionary/translator, "define x", "how do you say x in Spanish". For every other use I've found it extremely limited, you have to ask the right questions, otherwise it defaults to a web search on my wife's phone, even if she's not in the room.

How, after all these years, is it still so stunted? There are Telegram bots with better interaction.

dylan604• 4 years ago

I have never enabled Siri on any device. Precisely for fear of this kind of shit, or the ones where humans are listening to the recordings that are obviously being made, and all of the other logical conclusions one can reach on how this can be abused.

Just like HDD failures, it is not a question of if but when.

Aaronstotle• 4 years ago

I only enabled Siri because it was necessary for CarPlay, it's about a 50% success rate on getting anything right on the first try.

bdougherty• 4 years ago

I only ever use it in the car with CarPlay.

knodi123• 4 years ago

I switched from Android a few years ago because my company gives out iphones as a perk. I used "ok google" extensively, and loved it. It was incredibly good at answering obscure questions and doing things like navigating or playing a song. It would do what I wanted almost every time, even if I was trying a new command for the first time.

I try to use Siri for the same things, but she suuuuuuucks. If I ask her to play a song, 9 out of 10 times it will do something idiotic- like I say "hey siri play tears in heaven on spotify", she might reply "now playing tears in heaven by a shitty kazoo cover band". If I say "navigate to the closest olive garden", it would say "navigating to olive garden corporate headquarters, estimated travel time 43 hours 12 minutes." But never mind, I can see the olive garden I was looking for, it's at the end of the street I'm on.

These are artificial examples because I can't remember specifics right now, but trust me - the real examples were just as dumb.

She's great at setting timers or alarms though! And I can reliably use her to pause, skip, or adjust volume when I'm showering or something.

sbf501• 4 years ago

iPhone user since 2009. I used Siri for about a month when it first came out because I really liked hearing a British man's voice said "SSSSHedule" to me instead of "skedule", but then I learned it was sending all audio to the cloud and noped out.

crazygringo3• 4 years ago

When exercising and listening to a Spotify radio station, I use it to ask who the artist/song is.

That's literally the only thing.

dvzk• 4 years ago

I have never even setup Siri. Sometimes I've been tempted to enable it so I can say, "Siri, call 911!" if I'm assaulted or injured on the trail. I doubt it would help, but it's occasionally disconcerting when my phone isn't quickly accessible.

az_reth• 4 years ago

I use Siri exclusively to call my SO, because the way the British accent pronounces their contact name is just too funny.

corobo• 4 years ago

I only use it to set timers and it sucks at that half the time, not even going to bother with the faff of doing anything more complex. It's quicker to just do it myself as I'll probably have to unlock the screen anyway.

"Siri, timer, one hour thirty"

"Timers can't be set for a time of day, so I set your Timer alarm for 1:30"

Every damn time. Siri hates Brits.

lapcat3• 4 years ago

Don't forget that iOS and macOS silently re-enable Bluetooth on every software update. https://lapcatsoftware.com/articles/bluetooth.html

walterbell17• 4 years ago

Even worse, Control Panel buttons only "suspend" BT/WiFi, you have to go into Settings to turn them off again ... and again ... and again.

sixstringtheory2• 4 years ago

I called this a data grab from day 1 and stand by that. The amount of fellow iOS developers I've had argue for the "convenience" is astounding. There should be a settings toggle to control the auto-reenable behavior.

varenc2• 4 years ago

As a half solution: You can create a Shortcut that turns of BT/Wi-Fi completely. You can then add that Shortcut to your home screen for easy access. That's what I do and it's way nicer than going to Settings, though I wish it was just in Control Center.

stepanhruda• 4 years ago

It’s good UX - presumably most users want to turn off WiFi/bluetooth temporarily when using these buttons and this saves you from forgetting to turn it back on. I was delighted when they changed.

I agree it’d be nice to have a choice for how it works on your device, but current behavior would still be a good default.

runjake• 4 years ago

A $7,000 bounty for eavesdropping and TCC (app permissions) vulnerabilities. Insulting.

pxmpxm• 4 years ago

My first thought as well - the author must be doing this stuff as a hobby/for fun, because that's not nearly enough to comp you for the time spent.

rtev3• 4 years ago

This is why people sell bugs.

pvg7• 4 years ago

It's an example of why people report bugs to vendor bounty programs since you could not sell this bug for $7000.

concinds3• 4 years ago

Not just insulting to the dev, but to users as well. Any app on my Mac being able to eavesdrop at all times when wearing AirPods is "worth" just $7k to Apple?

I'm reminded about the Apple Music passage in the After Steve book, where Apple tried to fuck over musicians just because they thought they could get away with it (zero royalty payments during Apple Music trials, so the trial was 100% subsidized by labels and artists), before walking it back. The executives are clearly far more concerned with bad PR, and not guided by values or principles.

javajosh2• 4 years ago

That's incredibly low. This is a terrifying bug that deserved $70k, at least.

urbandw311er• 4 years ago

Also a $7k bounty 'when I reached out'. The guy actually had to chase it up by the sounds of it.

tinus_hn• 4 years ago

Wonder if it’d also be possible to send commands to Siri, that could also have some implications.

traceroute66• 4 years ago

I'm an avid iPhone user but have never had the need or the desire to use Siri.

I suggest people do what I do, load a profile that disables Siri - easily created using the Apple Configurator tool (under "Restrictions" untick "Allow Siri").

N.B. I've never looked closely under Settings on the phone itself, there may well be Siri off option there ? But I just load profiles as I find its easier for hardening.

sneak• 4 years ago

If you care about privacy, you should disable Siri and Dictation and blacklist guzzoni.apple.com.

atlex2• 4 years ago

Confused why you can’t use this to transcribe from any AirPods in your vicinity? I thought anyone could subscribe to a btle gatt attribute.

semireg• 4 years ago

The BLE peripheral (AirPods) have to be connected and paired. Then, this connected device was “explorable” via other apps on the same device because the actual connection is maintained by the middleware/OS… e.g. an app may disconnect from a peripheral but it’s only a request, and the OS will only truly disconnect if all apps are “disconnected.”

greenicon• 4 years ago

I wouldn’t have expected Opus in the AirPods. Unexpected from Apple and a quite interesting workaround around the mode switching.

walterbell17• 4 years ago

Opus patent trolls are pleasantly surprised :(

nick88msn• 4 years ago

Is there actually people using siri? It’s pretty useless here in Italy. Most conversations I guess could be something like “raise the volume” “call mom” or stuff like that.

mfbx9da4• 4 years ago

Yes when I’m cycling. Also for setting reminders and weather forecast

2T1Qka0rEiPr• 4 years ago

The struck-through:

and then receive a reply in the form of "here's what I found on the web...

Really made me chuckle. As a non-Apple user who has to put up with Homepods, this rings so very true.

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri

Related Stories