3 Major Issues with the Latest iPhone Tracking “Discovery”

ALex Levinson Security Blog ^ | April 21, 2011 | Alex Levinson

[Swordmaker]

Today, two researchers for O’Reilly media published an article claiming discovery of a hidden tracking system on the iOS 4 operating system. Using simple techniques, Alasdair Allan and Pete Warden extracted data off of an iOS version 4 device and wrote an open source software utility to effectively graph this data onto a map. As a fellow researcher, I champion their creativity and their development. As an expert in this field, I have three points of argument to raise.

1) Apple is not collecting this data.

And to suggest otherwise is completely misrepresenting Apple. I quote:

Apple is gathering this data, but it’s clearly intentional, as the database is being restored across backups, and even device migrations.

Apple is not harvesting this data from your device. This is data on the device that you as the customer purchased and unless they can show concrete evidence supporting this claim – network traffic analysis of connections to Apple servers – I rebut this claim in full. Through my research in this field and all traffic analysis I have performed, not once have I seen this data traverse a network. As rich of data as this might be, it’s actually illegal under California state law:

(a) No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person.

I don’t think that’s a legal battle Apple wants to face considering the sale of over 100 million iDevices worldwide. That raises the question – how is this data used? It’s used all the time by software running on the phone. Built-In applications such as Maps and Camera use this geolocational data to operate. Apple provides an API for access to location awareness called Core Location. Here is Apple’s description of this softare library:

The Core Location framework lets you determine the current location or heading associated with a device. The framework uses the available hardware to determine the user’s position and heading. You use the classes and protocols in this framework to configure and schedule the delivery of location and heading events. You can also use it to define geographic regions and monitor when the user crosses the boundaries of those regions.

Seems pretty clear. So now the question becomes why did this “hidden” file secretly appear in iOS 4?

2) This hidden file is neither new nor secret.

It’s just moved. Location services have been available to the Apple device for some time. Understand what this file is – a log generated by the various radios and sensors located within the device. This file is utilized by several operations on the device that actually is what makes this device pretty “smart”. This file existed in a different form prior to iOS 4, but not in form it is today.

Currently, consolidated.db lies within the “User Data Partition” on the device. This is a logical filesystem that maintains non-system level privileges and where most of the data is stored. When you perform an iOS Backup through iTunes, it is backing up this partition. Prior to iOS 4, a file called h-cells.plist actually existed in the /root/Library/caches/locationd folder, but with hidden access from other software and applications. h-cells.plist contained much of the same information regarding baseband radio locations as consolidated.db does now, but in Apple Property List format rather than sqlite3. Through my work with various law enforcement agencies, we’ve used h-cells.plist on devices older than iOS 4 to harvest geolocational evidence from iOS devices.

So lets recap.

h-cells.plist = Pre iOS 4 / Radio Logs including Geolocational Data / Hidden from Forensic Extraction (usually)

consolidated.db = iOS 4+ / Radio logs including geolocational Data / Easily acquired through simple forensic techniques

The change comes with a feature introduced in iOS 4 – Mutlitasking and Background Location Services. Apps now have to use Apple’s API to operate in the background – remember, this is not pure unix we’re dealing with – it is only a logical multitasking through Apple’s API. Because of these new APIs and the sandbox design of 3rd party applications, Apple had to move access to this data. Either way, it is not secret, malicious, or hidden. Users still have to approve location access to any application and have the ability to instantly turn off location services to applications inside the Settings menu on their device. That does not stop the generation of these logs, however, it simply prevents applications from utilizing the APIs to access the data.

3) This “discovery” was published months ago.

I understand that Mr. Allan and Mr. Warden are valued researchers for O’Reilly, but they have completely missed the boat on this one. In the spirit of academia, due diligence is a must to determine who else has done such research. Mr. Allan, Mr. Warden, and O’Reilly have overlooked and failed to cite an entire area of research that has already been done on this subject and claimed full authorship of it. Let’s break down my history:

Back in 2010 when the iPad first came out, I did a research project at the Rochester Institute of Technology on Apple forensics. Professor Bill Stackpole of the Networking, Security, & Systems Administration Department was teaching a computer forensics course and pitched the idea of doing forensic analysis on my recently acquired iPad. We purchased a few utilities and began studying the various components of apple mobile devices. We discovered three things:

• Third Party Application data can contain usernames, passwords, and interpersonal communication data, usually in plain text.
• Apple configurations and logs contain lots of network and communication related data.
• Geolocational Artifacts were one of the single most important forensic vectors found on these devices.

After presenting that project to Professor Stackpole’s forensic class, I began work last summer with Sean Morrissey, managing director of Katana Forensics on it’s iOS Forensic Software utility, Lantern. While developing with Sean, I continued to work with Professor Stackpole an academic paper outlining our findings in the Apple Forensic field. This paper was accepted for publication into the Hawaii International Conference for System Sciences 44 and is now an IEEE Publication. I presented on it in January in Hawaii and during my presentation discussed consolidated.db and it’s contents with my audience – my paper was written prior to iOS 4 coming out, but my presentation was updated to include iOS 4 artifacts.

Throughout the summer, I worked extensively with Sean on both developing Lantern and writing custom software to interpret forensic data for customers of ours who needed better ways of searching for and interpreting data.

When the iPhone 4 came out, I was one of the first people in San Francisco to grab one (yes I waited to be in the front of that awful line).

( Look for the RIT shirt )

Within 24 hours of the iPhone 4′s release, we had updated Lantern to support forensic analysis of iOS 4.0 devices. Within 36 hours, we had began writing code to investigate consolidated.db. Once a jailbreak came out for iOS 4, I wrote a small proof of concept application to harvest the contents of consolidated.db and feed it to a server for remote location tracking.

Ever since then, location artifacts have been a main area of interest for me. I’m now the Lead Engineer for Katana Forensics leading all technical research and development of both Lantern and private utilities. I travelled to Salt Lake City, UT in November for the Paraben Forensics Innovation Conference (PFIC) and presented with Sean on iOS Forensics including the content of consolidated.db. At that same conference, Sean and I announced the development of Lantern 2.0 which would fully support the interrogation of consolidated.db and other geolocational artifacts scattered throughout the device.

Sean and I even wrote a book detailing iOS forensics involving iOS 4 devices that came out on December 5th, 2010.

Sean Morrissey, Primary Author, Alex Levinson, Contributor

In the course of writing Chapter 10 – Network Forensics – I fully explain and detail the examination of consolidated.db and other network artifacts within the device!

Page 335 - Continued on page 336.

In February of 2011, Sean and I previewed Lantern 2.0 at the DoD Cyber Crimes Conference in Washington, DC including our geolocational features. Lantern 2.0 has been on the market for months now and performs the same functionality Mr. Warden’s utility does and much more. We correlate geolocational data embedded in images and third party application. We give you a geolocational timeline of events in list view showing much more than baseband logs within consolidated.db.

While forensics isn’t in the forefront of technology headlines these days, that doesn’t mean critical research isn’t being done surrounding areas such as mobile devices. I have no problem with what Mr. Warden and Mr. Allan have created or presented on, but I do take issue with them making erroneous claims and not citing previously published work. I’m all for creative development and research, as long as it’s honest.

[for-q-clinton]

Possibly. I may need to check my wife’s iPhone to confirm. Oh wait...I need to get her an iPhone so I can easily track her where abouts.

There’s no escaping this privacy issue for the iBots...this is bad anyway you look at it.

[Erik Latranyi]

When Google collects data, it is suspect.

When Microsoft has data leaks, fears are raised.

When Apple creates a log of your movements, it is defended.

Sorry, but anyone who defends this is a class-a hypocrite unless they can show where they have posted a defense of other companies doing the same thing.

[for-q-clinton]

There you go trying to put common sense into this. That will get you banned from the apple threads. They only like to listen to like minded pro-apple posts.

[Mind-numbed Robot]

Oh wait...I need to get her an iPhone so I can easily track her where abouts.

Couldn't she just go to the mall, or wherever, and then turn it off and go elsewhere? Upon completing her tryst she could return to the mall and turn it back on then go home.

There’s no escaping this privacy issue for the iBots...this is bad anyway you look at it.

As others have explained, I am not smart enough to know, the phone only stores the last time a tower or other hotspot was used, not each time it was used. That makes creating a long term map of travel impossible.

Also, for law enforcement purposes, a warrant for the information from the service provider will produce the same thing. I remember years ago a well know preacher in Dallas killed (allegedly) his wife to be with another woman. The strongest evidence against him was his cell phone records showing where he was when. So, this has been available a long time.

[longtermmemmory]

I agree this is disinformation.

Divorce lawyers include cell phone records in their discovery requests and this week this was the buzz for a new request to preserve this file as evidence.

Not just for affairs, but how many times did a person go to the bank? which bank?

[for-q-clinton]

1) She can’t just turn it off if she needs it to stay in contact and return my calls when I call her.

2) This does make a map...this is a bit of damage control in this thread that’s not 100% accurate.

3) The point is a warrant is a bit harder to get...but as it stands right now in Michigan police have a tool to grab this from an iPhone no warrant needed.

[Swordmaker]

Here’s how it’s relevant. Now you can grab a co-workers iPhone...grab this file off of it and find out where he’s been going for the past year.

Not that easy. You still have to get past the pass codes. It's also just been revealed that Android phones and devices send location data directly to Google several times an hour. . . not just keeps it on the phone for the phone's Apps' use, never sending it to Apple, as is the case with the iPhone. Apple does not mine this data for anything personal.

[Swordmaker]

Also you CAN turn location services off in iPhones and iPads. You can’t turn off the cell tower ID logging that is recorded. That’s in every phone including Windows7 phones. It’s part of the functionality of the phones. That’s what this is. That’s ALL this is. READ THE ARTICLE. Apple is not mining this data! That is illegal. The author states that as a fact. He also states as a fact that analysis of the signals coming from the devices have never found this data being transmitted. It is merely retained in the phone in a DB file for the purposes of the apps in the phone as he describes.

[Swordmaker]

Nothing in this article refutes the existence or magnitude of the problem; in one area, he basically confirms the worst case scenario. The author seems to be mainly concerned that he didn’t receive proper credit for finding out about these logs first. Apple should be scrambling to release a firmware update that lets the user turn off this data logging, and an application that allows past logs to be deleted from any computers or backups that were made when syncing.

Why??? The data is NOT as accurate as these breathless claims make out. It is a list of the cell towers locations and WIFI hotspots your phone was connected to as you moved around the areas you went. These can be as much as THREE MILES away from your real location. . . Or more. It is NOT GPS data at all. The author's point was not that he was the "discoverer", but rather that there is nothing "new" here because there was nothing to "discover!!!" This was all well documented (it's called "Core Location") and Apple had moved the file to make it more usable and was providing APIs for developers to USE this data in their apps! Turning it off would cripple many of the functions that make the iPhone work as well as it does!

The author of this article's specialty and his book are about the Forensic use of the data, nothing more. He is not worried about claiming discovery rights for this data... Because it wasn't a discovery.

There is NOTHING SINISTER about this data. It is just the FUD spin that these two ignorant "discoverers" are putting on something that they think they "found" that is making headlines among equally ignorant news people... And paranoid people who are believing the hype!

[Minus_The_Bear]

"I agree this is disinformation.

Divorce lawyers include cell phone records in their discovery requests and this week this was the buzz for a new request to preserve this file as evidence.

Not just for affairs, but how many times did a person go to the bank? which bank?"

____________________________________________

Plus the fact that this data is unencrypted. The people defending this sound like Obama supporters... no logic.

[Swordmaker]

2) This does make a map...this is a bit of damage control in this thread that’s not 100% accurate.

Sure it makes a map... It plots the cell tower and WIFI locations your phone has connected to around where you've been... What do you expect? It does not put a trail showing your pathway.

As for the Michigan Police? Don't give them permission to search you or your vehicle. They have to arrest you to search you or your vehicle without permission.

[Turbopilot]

Why???

Seriously? There's no good use for this data collection, and plenty of ways it could be misused. Would you want the IRS demanding you send them the file to prove any business trips or mileage deductions you've taken? The police calling you in for an interview because you were in the same area at the same time a crime was committed? Apparently at least one police department in Michigan already has the ability to pull saved data off cell phones, so this is not just a theoretical concern.

The author is cavalier because he's in forensics, so from his perspective these data can be useful. From a consumer's perspective, I don't want to be under a forensic microscope - I at least deserve the choice of whether or not I want this information about myself collected.

It's not FUD. The data are being collected, and while it may not be as accurate as GPS coordinates, it's a lot more accurate than your worst-case 3 miles estimate, in most cases. I absolutely stand by my original comment that Apple should immediately release a software update that allows the user to turn off this data collection feature and delete any previously saved logs both on the phones and on any computers they're backed up to.

[Swordmaker]

Plus the fact that this data is unencrypted. The people defending this sound like Obama supporters... no logic.

Good grief. It's unencrypted because most people with iPhones and iPads CHOOSE not to encrypt the iPhone files. It is perfectly possible to encrypt them to 256 bit AES encryption if the user wants it. Most don't worry about it. As I've pointed out the accuracy of this data is REALLY poor... Like a three mile radius for cell tower IDs. . . 300 feet for WIFI hotspots. . . At worst.

[moehoward]

Add to which reports today on fox that Android/Google does the same with the added twist the info is tied to the actual device.

iPhone post.

[Swordmaker]

Seriously? There's no good use for this data collection, and plenty of ways it could be misused. Would you want the IRS demanding you send them the file to prove any business trips or mileage deductions you've taken? The police calling you in for an interview because you were in the same area at the same time a crime was committed? Apparently at least one police department in Michigan already has the ability to pull saved data off cell phones, so this is not just a theoretical concern.

There certainly IS a good use for this data. It's used to assist the GPS in finding locations in seconds rather than minutes. From other reading on the Core Location DB file, it's my understanding that each cell tower's data is replaced at each encounter. It is against the law for Apple to track anyone. . . As pointed out by the article. If Apple were doing it, they would be at risk of severe legal repercussions.

As for IRS seeking confirmation, I have no fear of that as my claimed mileage is legitimate. Isn't yours? Fourth amendment, anyone? The cell towers in the vicinity of the crime scene already have the ID code of your phone. The police have no need of your phone's log. It's proves nothing.

Are you aware that Google Android phones have been found to report their GPS location several times an hour to Google, not just keep a log of cell towers and hotspots in a file on the phone and cached on the phone owner's computer???? What is GOOGLE doing with those data???

[Turbopilot]

There certainly IS a good use for this data. It's used to assist the GPS in finding locations in seconds rather than minutes.

That might* be a good reason for the phone to know where it is "now". So might geotagging pictures or getting driving directions from your current location. But none of those reasons require or are benefitted by the phone keeping a log of where it was a week, a month, or a year ago.

*-iPhones and iPads can locate themselves very precisely with GPS in seconds, not minutes, even without the benefit of a 3G signal, so the devices don't even need current cell tower position information to work just fine.

From other reading on the Core Location DB file, it's my understanding that each cell tower's data is replaced at each encounter.

Have you looked at a map of the data stored from a phone? Your understanding does not comport with the information displayed on such a map.

If Apple were doing it, they would be at risk of severe legal repercussions.

I couldn't care less if Apple (or Google, or Microsoft, or Nokia) were collecting the data, although there's no technical reason why they couldn't. It's the potential use by government or private parties who might want to track me, personally, that's the problem.

As for IRS seeking confirmation, I have no fear of that as my claimed mileage is legitimate. Isn't yours?

Of course. I just don't want to have to go through yet another layer of data collection to prove it. Nor do I think the IRS needs to know where I went on vacation or how I spend my Saturday nights because they demand my location data so I can deduct my business expenses, even though my activities in those situations are entirely legal.

Are you aware that Google Android phones have been found to report their GPS location several times an hour to Google, not just keep a log of cell towers and hotspots in a file on the phone and cached on the phone owner's computer???? What is GOOGLE doing with those data???

I was not aware. But I was very young when I learned that just because one person is doing something wrong, it's not okay for someone else to do the same thing. Google should release an update giving Android users the ability to shut off that data collection, just as Apple should.

[for-q-clinton]

Not that easy. You still have to get past the pass codes.

Dude...you don't know what you're talking about. The devices passes any pinlocks and passcodes. So yes it is that easy.

I agree google has issues too. What I don't know is if Android allows you to turn it off. My friend who has an android swears he can, but I think he's confused.

I know on my windows phone 7 I can turn it off though. I don't know if MS is still recording the info though, but so far it appears Windows phone 7 is the phone to get if you care about privacy.

[for-q-clinton]

Michigan police. Well that’s not really an option right now :-( That’s why the ACLU is getting involved.

[for-q-clinton]

There certainly IS a good use for this data. It's used to assist the GPS in finding locations in seconds rather than minutes.

Two things. Windows phone 7 has an option to turn on this feature for fast finding the phone (by default it is off).

Two why does Apple need to keep a history of it forever and then transfer it from device to device?

[for-q-clinton]

The people defending this sound like Obama supporters... no logic.

True. But isn't that the norm? This is the typical way these threads go when apple has bad press.

In this thread the iBots say it's ok because Apple isn't doing anything with the data (even though WSJ shows the data going back to Apple). Then they say but Google is doing it and tracking it every hour so that's bad, but it's ok for Apple to do similar things.

One of my favorites on another topic is that the Apple Max OSX was the first hacked machine for 3 years in a row at a hacking competition. Yes Linux and Windows both were more secure and took longer to hack. At first they were silent for at least 1 week...then they got their marching orders. The reason it happened is it took a NASA scientist to hack the Mac and it was pre-staged (3 years in a row!!!). As if that makes it any better. It's not like Russia and China doesn't have any smart hackers ya know. But to them it's ok because it was just one uber smart guy that was able to hack the Mac...while it took others more time to hack Linux and Windows. I know it makes no sense but hey it's like you said they remind us of Obama supporters.