Apple Gave Uber's App 'Unprecedented' Access to a Secret Backdoor That Can Record iPhone ScreensHowever, there is no evidence that Uber used this access to take advantage of the iPhone features.

ByKif Leswing

This story originally appeared onBusiness Insider

Reuters/Lucas Jackson via BI
Apple CEO Tim Cook and former Uber CEO Travis Kalanich are friendly.

Uber's iPhone app has a secret backdoor to powerful Apple features, allowing the ride-hailing service to potentially record a user's screen and access other personal information without their knowledge.

The existence of Uber's access to special iPhone functions is not disclosed in any consumer-facing information included with Uber's app, despite giving the company direct access to features so powerful that Apple almost always keeps them off limits to outside companies.

Although there is no evidence that Uber used this access to take advantage of the iPhone features, the revelation of the app's access to privileged Apple code raises important questions for a company already under investigation for a variety of controversial business practices.

Uber toldBusiness Insiderthe code was not currently being used and was essentially a vestige from an earlier version of its Apple Watch app, but it set off alarm bells among experts.

“第三给予这样一个敏感的权利party is unprecedented as far as I can tell, no other app developers have been able to convince Apple to grant them entitlements they've needed to let their apps utilize certain privileged system functionality,"Will Strafach, a security researcher who discovered the situation, toldBusiness Insider.

Here's how it works

Nearly every iPhone app uses what is called an "entitlement" -- basically a way for software to enable features like the camera or Apple Pay on iPhones and iPads. Most of these can be easily found and officially turned on by outside app developers.

But there are certain entitlements that are only used by Apple, giving the company's own software tight integration with the iPhone. These bits are marked with names that start with "com.apple.private," and they are considered so sensitive that any third-party app found using them is rejected from the App Store.

After digging around in the code for Uber's app, Strafach discovered that it uses an entitlement called "com.apple.private.allow-explicit-graphics-priority."

"It is very odd to see Uber as the only app (I checked tens of thousands of other apps usingmy company's internal datasetderived from the App Store) besides Apple's own apps granted access to this sensitive entitlement," Strafach said in an email. Another person said that no other of the 200 top free apps use private Apple entitlements.

Uber says Apple gave it permission to use the private entitlement, which it used for an earlier version of its Apple Watch app to render maps on the iPhone. The entitlement is not currently being used, Uber says.

"Apple gave us this permission because early versions of Apple Watch were unable to adequately handle the level of map rendering in the Uber app," Uber representative Melanie Ensign toldBusiness Insider."Subsequent updates to Apple Watch and our app removed this dependency and we're working with Apple to remove the API completely."

Lot of other iOS developers would like special access to private Apple entitlements for both legitimate and illegitimate purposes.

The one Uber was using, for example, could be used to record a user's screen, Thomas Jansen, founder of security research companyCrissy Fieldsaid. "Imagine any app would be able to use an entitlement like that and just record your screen without you knowing," he said. That's why Apple doesn't allow just any company to use private entitlements.

Apple didn't comment. But one reason why Apple may have let Uber use this sensitive piece of code -- which likely would have needed to have been approved by senior management -- is because the Uber app was demonstrated on-stagewhen it launched the Apple Watch in 2015and Uber was a launch app for the Apple Watch.

Hard to trust

Uber has been caught violating the rules of the App Store and has a history of pushing boundaries when it comes to building software thatmay break legal or ethical boundaries.

After using internal Apple abilities to tag and track individual iPhone devices, even after they were wiped, former Uber CEO Travis Kalanick was summoned to Apple's headquarters. There, he was scolded by Apple CEO Tim Cook, who in a private meeting with Kalanick threatened to pull the Uber app from the App Store,theNew York Timesreported.

The meeting between the two CEOs reportedly took place in early 2015, around the same time Apple launched the Apple Watch.

"I guess there is some kind of extremely special relationship there, considering Apple granted them exclusive access to a privileged IOKit API a little while after they were abusing other unrelated IOKit APIs in violation of the App Store rules (with no repercussions at all)," Strafach surmised.

The deception apparently didn't scare Apple:Texts published as part of a lawsuitrevealed that Kalanick privately said he continued to meet with Cook, with one meeting supposedly taking place in May 2016, as well.

Apple became an Uber investor through its investment in Chinese ride-hailing company Didi Chuxing. In 2016, Didi merged with Uber's Chinese subsidiary.

Kalanick is no longer the CEO of Uber. Uber's current CEO, Dara Khosrowshahi, has not yet said anything publicly about the $69 billion startup's relationship with Apple, buthas addressed the company's rule-bending culture. A recent change to iOS, the iPhone software, prevented Uber from collecting rider location in the backgroundwithout a visual signal.

Wavy Line
Kif Leswing

Contributing Writer

Kif Leswing has been a contributing writer forFortunesince 2015.

Editor's Pick

Related Topics

Growing a Business

We're Now Finding Out The Damaging Results of The Mandated Return to Office — And It's Worse Than We Thought.

Companies knew the mandated return to the office would cause some attrition, however, they were not prepared for the serious problems that would present.

Business Solutions

Learn to Program an AI Chatbot for Your Business in This $30 Course

Get back-to-school savings on this AI coding course.

Money & Finance

Want to Become a Millionaire? Follow Warren Buffett's 4 Rules.

企业家是不能过度指狗万官方望太多a company exit for their eventual 'win.' Do this instead.

Business News

Netflix is Hiring an AI-Focused Role—and the Starting Salary is up to $900,000

The streaming giant is looking for a leader in its machine learning department.

Thought Leaders

Mark Cuban Says These are the Dumbest Things Entrepreneurs Do

Whatever you do, don't do the first thing on this list. Or the second. Definitely not the third.

Leadership

This Common Leadership Habit Will Harm Your Credibility. Are You Guilty of It?

As leaders, we're always looking for ways to build credibility among peers and employees. But this easy-to-make mistake can ruin it in an instant.