Security researcher Will Strafach latterly revealed that Apple selectively grants (what's known every bit an "entitlement") Uber a powerful mightiness to move the newly introduced screen-recording API amongst intent to meliorate the functioning of the Uber app on Apple Watch.
The screen-recording API allows the Uber app to tape user's covert information fifty-fifty when the app is closed, giving Uber access to all the personal information passing through an iPhone screen.
What's more? The company's access to such permission could brand this information vulnerable to hackers if they, somehow, able to hijack Uber's software.
"It looks similar no other third-party developer has been able to become Apple to grant them a individual sensitive entitlement of this nature," Strafach told Gizmodo, who showtime reported well-nigh the issue. "Considering Uber's by privacy issues I am really curious how they convinced Apple to allow this."
Shortly later the populace disclosure, Uber said it would take the entitlement code from its iPhone app's codebase that lets the ride-sharing app tape the covert fifty-fifty if running inward the background.
Although it's unclear when or for how long Uber's iPhone app has had this permission, Uber spokesperson said inward a tweet that the entitlement was used for an quondam version of the Apple Watch app together with was provided to Uber because the master copy Apple Watch could non homecoming maps.
However, due to upgrades to Apple Watch together with the Uber app, the companionship does non postulate this permission anymore.
Nearly every iPhone app uses entitlement inward an endeavour to enable features similar the photographic television receiver camera or Apple Pay on iPhones together with iPads. However, according to Strafach, Apple does non oftentimes grant "sensitive" entitlements to non-Apple apps.
Strafach said he could non uncovering whatever other app on the Apple's official App Store that has the permissions that the Uber app has.
Although in that place is no prove that Uber always misused the entitlement, this exceptional permission could convey been exploited to perform a broad attain of activities on an iPhone, such every bit recording passwords, monitoring users together with harvesting other personal information, Strafach explained.
Apple has non nonetheless responded.
This is non the showtime privacy describe organisation surrounding Uber. Late final year, the ride-hailing companionship was constitute tracking its users' locations fifty-fifty later their rides ended.
Uber was besides inward controversies at the mid of final twelvemonth for monitoring the battery life of its users, every bit the companionship believed that its users were to a greater extent than probable to pay a much higher toll to hire a cab when their phone's battery is around dying.
