History I think everyone remembers the scandal (around November 2019) about an app in which the camera was activated in the “background” due to a bug. If you missed it, quickly Google it. The online media was full of these kinds of articles at that time. Then my mind did not let me sleep… Camera Permission on iOS from Apple: Description In iOS, the user must explicitly grant permission for each app to access cameras and microphones. Before your app can use the capture system for the first time, iOS shows an alert asking the user to grant your app access to the camera, as shown below. The user can change permission settings for your app in Settings > Privacy. iOS remembers the user’s response to this alert, so subsequent uses of the capture system don’t cause it to appear again. Camera API is pretty straightforward. You define which camera hardware you would like to use, how to show a preview, and where to save the files. The Camera API usage The Problem As you see from the documentation above, once the user grants the Camera Permission for an app, it is granted. Forever. Anyone can make an application that asks for Camera Permission. e.g. taking a photo, uploading an image, setting profile picture, “scanning” document, etc. You can find many use-cases that can justify camera usage. The application can ask it for a valid reason, but after that, you don’t know what can happen. And do you know if the app is still using your camera while you are in the app? Probably not. Let your imagination fly a bit and think about what you could do if you could have access to the user’s camera anytime in the app. You have a home decor online shop. While the user is searching for a certain item in your app you could look around in his/her house, see the colors, furniture, and your app could start suggesting extra items in matching style. Or: Your main revenue stream is displaying ads in your app. What if you could monitor the user’s reaction to an ad? Then you could offer to your advertiser more insights about what kind of ads a certain type of user likes. This information would be pretty valuable, right? Ethical? I don’t think so. Proof of Concept The Good If you would like to go straight to the code, here you are: app on GitHub. Note: HiddenCamera As a first step, you have to define the key Info.plist file of your application. You have to define a purpose string for this key why your app needs this permission. Obviously, taking pictures… right? NSCameraUsageDescription This description will be part of the alert message that will be shown to the users the first time when they use your app. So, let’s take a look at our . CameraViewController We need to initialize an . AVCaptureSession session = () let AVCaptureSession This session is the base of everything. Here we can attach our input/output elements. deviceInput: ! session.sessionPreset = . .vga640x480 device = . ( . .builtInWideAngleCamera, : .video, position: . .front) { } { deviceInput = (device: device) deviceInput != { ( ) } .session.canAddInput(deviceInput){ .session.addInput(deviceInput) } videoDataOutput = () videoDataOutput.alwaysDiscardsLateVideoFrames = videoDataOutputQueue = (label: ) videoDataOutput.setSampleBufferDelegate( , queue: .videoDataOutputQueue) session.canAddOutput( .videoDataOutput){ session.addOutput( .videoDataOutput) } stillImageOutput = () session.canAddOutput(stillImageOutput) { session.addOutput( .stillImageOutput) } videoDataOutput.connection(with: .video)?.isEnabled = previewLayer = (session: .session) previewLayer.videoGravity = .resizeAspect session.startRunning() } error { deviceInput = ( ) } var AVCaptureDeviceInput AVCaptureSession Preset // acquire the camera device guard let AVCaptureDevice default AVCaptureDevice DeviceType for AVCaptureDevice Position else return do try AVCaptureDeviceInput guard nil else print "error: can't get deviceInput" return // add the Input device to the session if self self // define a Video output device to capture video frames from the camera AVCaptureVideoDataOutput true DispatchQueue "VideoDataOutputQueue" self self if self self //define a Picture output device to capture still images from the camera AVCapturePhotoOutput if self true // define the camera preview view AVCaptureVideoPreviewLayer self AVLayerVideoGravity // ... // and start running the capture session catch let as NSError nil print "error: \(error.localizedDescription)" The method kicks in the whole capturing process. (This will be important later!) startRunning() Now we can listen to the video delegate callbacks: { } func captureOutput ( output: AVCaptureOutput, didOutput sampleBuffer: CMSampleBuffer, from connection: AVCaptureConnection) _ // do stuff here with the video Then to the photo delegate callbacks: { imageData = photo.fileDataRepresentation() { } captureImageView = (frame: (x: , y: , width: , height: )) image = (data: imageData) captureImageView.image = image centerView = (frame: (x: .main.bounds.size.width / - , y: .main.bounds.size.height / - , width: , height: )) centerView.backgroundColor = .red centerView.addSubview(captureImageView) .view.addSubview(centerView) } func photoOutput ( output: AVCapturePhotoOutput, didFinishProcessingPhoto photo: AVCapturePhoto, error: Error?) _ //process single image guard let else return let UIImageView CGRect 50 50 100 100 let UIImage //show the captured image let UIView CGRect UIScreen 2 100 UIScreen 2 100 200 200 UIColor self As you can see, nothing evil. We ask for permission, the user grants it, we show the video preview and the captured photo. Let’s see how it works: The Bad We can take a look on the class. Same thing as above, but unfortunately by mistake we forgot to attach our video preview to the view. CameraViewControllerHidden { deviceInput = (device: captureDevice) deviceInput != { ( ) } .session.canAddInput(deviceInput){ .session.addInput(deviceInput) } stillImageOutput = () session.canAddOutput(stillImageOutput) { session.addOutput( .stillImageOutput) } session.startRunning() } // ... do try AVCaptureDeviceInput guard nil else print "error: can't get deviceInput" return if self self AVCapturePhotoOutput if self // we can also attach videoDataOutput from the previous example to get all the video frames // but for now image capturing is enough // and whoopsie, we forgot the preview :( // ... What do we see now? No permission was asked (previously it was granted forever), no video preview. So we think everything is alright, we are browsing our feed, watching ads, liking/disliking photos… meanwhile someone is spying on us: Just to give you a little peace of mind: at least the camera stream is blocked while the app is in the background. Jailbreak to the Rescue What is ? Jailbreaking Jailbreaking is the privilege escalation of an Apple device for the purpose of removing software restrictions imposed by Apple on iOS, iPadOS, tvOS and watchOS operating systems. This is typically done by using a series of kernel patches. Jailbreaking permits root access in Apple’s mobile operating system, allowing the installation of software that is unavailable through the official Apple App Store. Many types of jailbreaking are available, for different versions. Apple publicly disapproves of jailbreaking. There are a lot of pros and cons of jailbreaking. You can find some of these on the above-mentioned links. Jailbreaking is for users who know what they are doing. And these people like to jailbreak for tweaking their devices. Just take a look at you can do on your iOS device once it is jailbroken. all the magic The Tweak The are iOS applications, however tweaks …many of them are not typical self-contained apps but instead are extensions and customization options for iOS and its features and other apps (commonly called tweaks). Users install these programs for purposes including personalization and customization of the interface by tweaks developed by developers and designers, adding desired features and fixing annoyances… PrivacyGuard — iOS This post is not elaborating how to develop a Jailbreak tweak. That’s for a future post. If you want to hear more about it, please subscribe to the . Note: content notifications As you read above, most of the Jailbreak tweaks are extending the functionality of already existing apps. How? In a nutshell, they hook into existing methods in the app and react when the method is called. They can completely override it, alter its behavior, or just trigger a jailbreak code and call the original method after it. This is exactly what we will do. If you would like to go straight to the code, here you are: tweak on GitHub. Note: PrivacyGuard-iOS As we saw above in the camera app examples, everything starts with the method on . startRunning() AVCaptureSession It’s time to ! hook %hook SpringBoard -( ) applicationDidFinishLaunching:( )arg { %orig(arg); *lookWhatWorks = [[ alloc] initWithTitle: message: delegate: cancelButtonTitle: otherButtonTitles: ]; [lookWhatWorks show]; } %end %hook -( ) startRunning { *appName = [[ mainBundle] objectForInfoDictionaryKey: ]; ( , appName); *statusBar = [[ sharedApplication] valueForKey: ]; statusBar.backgroundColor = [ greenColor]; %orig; } -( ) stopRunning { ( ); *statusBar = [[ sharedApplication] valueForKey: ]; statusBar.backgroundColor = [ clearColor]; %orig; } %end #import <UIKit/UIKit.h> void id UIAlertView UIAlertView @"PrivacyGuard Tweak" @"Your privacy guard is running 😎" self @"OK" nil AVCaptureSession // Hooking an instance method with no arguments. void NSString NSBundle @"CFBundleIdentifier" NSLog @"PrivacyGuard startRunning: %@" UIView UIApplication @"statusBar" UIColor void NSLog @"PrivacyGuard stopRunning" UIView UIApplication @"statusBar" UIColor // or we could save and restore the original one // Always make sure you clean up after yourself; Not doing so could have grave consequences! Easy (for now) and beautiful! (The first part, hooking into , just a helper notification to show the tweak is initialized.) Springboard We hook directly into 's method. Whenever this method is called we log to the console the current app that is using the camera (initiated the capturing) and change the status bar color to green to visually notify ourselves. After this is done we just call the original ( ) method and let the flow continue. Hooking into the method is useful to revert our changes after the camera is not in use anymore. AVCaptureSession startRunning() %orig stopRunning() How does it look while using the example apps above? When you have the preview visible: And when we are in evil mode: Also, in the logs we can see the relevant app info: And no hidden surprises anymore. You can go further. Showing a popup, notification, or a little icon in the status bar while the camera is in use. It is all up to you! PrivacyGuard-iOS is not available in any Jailbreak repository (yet). If you have the urge to try it, please let me know. But also feel free to compile it and tweak it for yourself. Note: If there are other ways of accessing the camera stream those were not part of this investigation. Probably there you can use the same approach. Note: Conclusions Jailbreak Tweaks The tweaks made by the Jailbreak community are amazing. A lot of smart ideas, solutions for daily annoyances. Having the possibility to use a jailbroken device and develop your own tweaks for your development work can be really interesting. It opens your possibilities, you have more access to the system, you can debug more things, private APIs. It is brilliant. Camera API I think you can draw your own conclusion. Be aware of your apps and used services. Maybe you don’t even need those apps, just try to use the web version of those services. Check the granted permissions of your apps, maybe for your use-case it does not need extra permission. Sensitive permissions should not be granted forever. Hopefully, Apple will fix this issue soon like Google is doing it on now. Android 11 Disclaimer I don’t say that any of these things are happening in any apps on the market and I don’t encourage you to jailbreak your iOS device. But better to be prepared and be more privacy-conscious. Having these kinds of data collected about a user/content/ad could be valuable for certain parties. What’s next? We will look around on Android. Stay tuned and register for content notifications!
