Hacker News Reader

Comment by aaronpk | Hacker News Reader

At the end, the author mentions that this type of software is available for iOS as well. My understanding of iOS is that this kind of thing is virtually impossible, because 1) apps must be distributed through the app store, and will be removed if found to be spyware, and 2) app developers have much less ability to do things in the background, especially using the microphone and camera. Is there anything written about actual examples of this kind of spyware on iOS yet?

View on HN

No. It's misleading to say it works on iOS. There are some companies who sell spyware that works by using the iCloud password you provide to get certain data from there.

But there is no easy service you can buy to start monitoring cameras and microphones.

In general it's more secure than Android.

Your entire comment is misleading. To install things from an APK on Android you have to go into the settings, disable security, download the APK and click through multiple prompts.

On iOS, you can't disable security at all (yay freedom), but you can just jailbreak the phone and install whatever you want. If the attacker has physical access to the phone, security on both platforms is comparable, i.e. zero.

Jailbreaks have been much harder to come by since iOS 10. There actually hasn't been a publicly available jailbreak of the current version of iOS since ios 9.3.4. The only way to have a jailbroken phone on 10 was to know ahead of time to stay on iOS 10.1.1. By the time the 10 jailbreak was available Apple had already patched the vulnerabilities and made it impossible to downgrade. It's not something you can do on the spur of the moment. Either you spend an ungodly amount of time writing your own jailbreak, or you monitor reddit like a hawk trying to anticipate which version of iOS is most likely to be hacked in the future.

On top of that there is no such thing as an unteathered jailbreak for iOS 10. The best you can hope for is a semi teathered jailbreak which requires you to manually run an app every time your phone restarts.

It's not misleading, even if you have the device, there is no way currently on iOS to secretly do nasty things like remote audio and video monitoring.

Also doing all those steps you mention are meaningless is many cases because an attacker close to you (think bitter divorce or corrupt business colleague) can just grab your phone for a minute and your goose is cooked.

Except that the current generation of iPhones is not (at the moment) able to be jail broken at all.

No you cannot jailbreak a iPhone with a secure enclave unless you have the passcode or the finger.

To install spyware on an ios device, it needs to be jail broken. IMO jailbreaking an ios device is slightly more difficult than sideloading an app onto an Android device. If an attacker has physical access to your device, it's game over.

Apps can be distributed outside of the app store, but you need to know specific device information. Not very difficult though if you have physical access to the phone.

Reply on news.ycombinator.com