Major Safari Privacy Bug Exposes EU iPhone Users to Tracking

If you're an iPhone user in the European Union running the latest iOS version, you could be vulnerable to stealthy tracking due to a "catastrophic" flaw in Safari's implementation of alternative app stores, according to researchers.


The issue stems from Apple's new mechanism to comply with EU laws requiring it to allow third-party app marketplaces on iOS. With iOS 17.4, a "URI scheme" lets EU users easily install alternative store apps from their website with a tap.

But iOS developers Talal Haj Bakry and Tommy Mysk revealed this URI scheme opens the door to cross-site tracking and injection attacks that put user privacy at risk.

"This makes the perfect recipe for a malicious marketplace to be able to track users across different websites," the duo warned.

Flawed Security Safeguards

At the core of the problem is a critical oversight in how Safari handles URL checks for the alternative app store links. Rather than strictly verifying if a website is an approved marketplace before invoking the URI scheme, Safari will blindly accept any parameters once triggered.

This means a malicious actor could embed cleverly disguised tracking pixels or scripts across the web. When an unwitting user taps the seeming "install" button, Safari would fire off data to the attacker's servers instead.

The researchers also found other vulnerabilities enabling request hijacking and manipulation once the URI scheme initiates.

Apple Dropped the Ball on Privacy

While Apple has touted user privacy as a key selling point, Bakry and Mysk argue these blatant security holes reveal a alarming lack of foresight in the company's approach to third-party app stores.

"Apple must have forgotten that this is the web, and developers can actually style HTML buttons to virtually look like anything," they wrote.

They pointed out that Brave browser gets the implementation right by properly checking website origins before allowing URI scheme invocations. In contrast, "Apple finds it more important to check if the scheme call came from an HTML button event than checking for cross-site invocation."

The flaws are made worse by Apple's already questionable app review process that has repeatedly failed to catch malware and scams on the official App Store.

For now, the researchers strongly advise all EU iPhone users to switch to Brave or other secure browsers to avoid the Safari tracking vulnerabilities. They also plan to investigate if similar risks exist when the iPad inevitably adopts the same app sideloading policies soon.

Push for Control Backfires

Ultimately, the researchers believe Apple's insistence on controlling sideloaded app distribution, rather than an open approach, opened this entire security can of worms.

The push for tighter regulation and interoperability was meant to foster more open mobile ecosystems and increase consumer choice. But in trying to maintain its historically closed model, Apple may have inadvertently created an even bigger privacy nightmare for its European user base.

With significant backlash already growing, it will be fascinating to see how - or if - the tech giant properly addresses these URI scheme vulnerabilities going forward. For now, EU iPhone owners have good reason to remain extremely cautious when dealing with any alternative app stores on mobile Safari.

ochuko Evidence

Ochuko Evidence is a seasoned content writer with a proven track record of crafting engaging and optimized content across various platforms. With a deep understanding of SEO optimization techniques, he specializes in creating content to resonates with audiences.

Post a Comment

Previous Post Next Post