This infringement on privacy and adherence challenges undermines iPhone Mirroring

Privacy: Initially, supervised business Macs are collecting information regarding applications utilized on individually-owned iPhones, potentially leading to a breach of privacy and posing a significant issue depending on the circumstances. (For example, an employee in an authoritarian regime where the use of VPN or LGBTQ apps is restricted may have their app usage exposed by this flaw, resulting in potentially severe repercussions.)

Compliance: The subsequent issue relates to regulatory conformity: Should a compliance auditing tool detect the use of an unauthorized iPhone application on a corporate network, which is likely due to the design flaw of this system, IT will be obligated to investigate and account for that utilization. This introduces organization-wide compliance hurdles, potentially forcing administrators to expend time on what ought to be a relatively minor concern.

The iPhone Mirroring mishap isn’t a concern for smaller enterprises that do not utilize device management or compliance mechanisms since, in theory at least, the gathered data is inaccessible to anyone except the authorized Apple ID/user of a system. Nonetheless, the existence of this data could offer an additional vulnerability for potential data breaches.

What is the issue?

The glitch was initially identified in late September by Sevco Security, a company not specializing in Mac development. It discovered that whenever iPhone Mirroring is activated, each iPhone app generates an entry in a library item on your Mac. Essentially, this occurs because the Mac treats these apps as if they are native to the Mac, despite actually running on an iPhone.

A detailed explanation of this behavior can be found in Sevco’s report (above), but essentially, executing the mdfind CLI (Command Line Interface) in Spotlight should display a comprehensive compilation of both iPhone and Mac applications used on the Mac. Typically, only Mac applications are visible, but with iPhone Mirroring, iPhone applications also become visible. This data is then stored in a concealed library file on the Mac, which the majority of users are unlikely to encounter.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts