Hacker News Reader

Comment by tedunangst | Hacker News Reader

Apparently people think there's a secret backdoor that lets an iPhone app record audio without turning the status bar red. You could deny mic permission and people would still think it's the secret backdoor.

View on HN

There was a backdoor that let the Uber iPhone app record the screen invisibly from the background that went unnoticed for years.

Well no, Apple (in an unprecedented move), granted the Uber app the com.apple.private.allow-explicit-graphics-priority entitlement.

    "Apple gave us this permission because early versions of Apple Watch
    were unable to adequately handle the level of map rendering in the Uber
    app," an Uber representative, Melanie Ensign, told Business Insider.
    "Subsequent updates to Apple Watch and our app removed this dependency,
    and we're working with Apple to remove the API completely."

Uber was doing other sneaky stuff to read the devices serial number (or other unique identifiers) and evade Apple's countermeasures, but that's seperate from this.

What is the meaningful difference, in the context of tedunangst's post, between an entitlement that allows surreptitious recording of video and a backdoor that allows surreptitious recording of audio?

Uber's entitlement was always 'public'. Facebook doesn't hold any private entitlements that would allow it to record audio in the background without notifying the user.

I'm 95% sure that there will be an entitlement for recording audio without showing the red mic bar (look at the Phone app), but it won't be a public one. There is no way for a third party app to get past app review with a custom entitlement without explicit permission from Apple. I'd be very surprised if it even passed automated review when the app was uploaded.

Recording audio from an iOS app does not turn the status bar red, FYI.

It does for me while outside the app; tested with FaceTime (Built-in), Voice Recording (Built-in, recording not streaming), Snapchat, and Discord.

Inside the app I believe they can record whenever, without the banner appearing.

It does if the application isn't running in the foreground.

Reply on news.ycombinator.com