https://www.mysk.blog/2021/10/24/accelerometer-ios/ Skip to content Mysk * Mysk Inc. * Canvas * Ctrl * + Back * Twitter iPhone Apps Can Tell Many Things About You Through the Accelerometer Posted byTommy October 24, 2021October 28, 2021 1 Comment on iPhone Apps Can Tell Many Things About You Through the Accelerometer By Tommy Mysk If you enjoyed this work, you can support it by checking out our apps: * Ctrl - The best presentation companion for your Apple Watch * Canvas - Draw Together, Wirelessly! tl;dr Nearly every modern smartphone is equipped with an accelerometer, which as the name implies, is a sensor that measures acceleration. It's most commonly used for detecting the device's orientation. It's also found many other uses, whether as a game controller in racing games, as a pedometer for counting daily steps, or to detect falls as seen in the Apple Watch. There also have been some research to develop novel accelerometer applications: estimating heart rate, breathing rate, or even as a rudimentary audio recorder using just the accelerometer. Currently, iOS allows any installed app to access accelerometer data without explicit permission from the user. Curious apps might be able to learn a lot about users through the accelerometer and without their knowledge or permission. Video Facebook reading the accelerometer The Accelerometer in iOS The iPhone is equipped with accurate accelerometer and gyroscope hardware. It can measure the altitude, rotation rate, and acceleration of your iPhone with high accuracy. Steve Jobs demonstrated the capabilities of these two sensors during the introduction of iPhone 4. Steve Jobs demonstrates the accelerometer and gyroscope sensors (Fast forward to 17:45) The accelerometer and gyroscope are bundled together in iOS and are part of the Core Motion Framework. For the sake of brevity, I will just say accelerometer to refer to both sensors. The accelerometer has tons of applications and many apps rely on it. Most users won't realize it when their favorite apps use the accelerometer. This is simply because apps don't need a permission to read accelerometer data. Unlike access to location services and Bluetooth, access to the accelerometer is granted to all apps on the iPhone. So apps can read measurements from the accelerometer without any restriction- except for one. Apps can only read the accelerometer when they are active in the foreground. iOS prevents apps running in the background from reading the measurements. Apps that access resources protected by a system permission have to specify why they need such an access. Developers have to formulate the reason in a simple description that conveys the message to the users. iOS shows the description on the permission dialogue when the app requests a permission from the user. Apps that don't provide such information for each permission they need will not be approved by Apple's App Review team. Since access to the accelerometer is not protected by a system permission, developers are not required to inform users about why they need the access. [telegram_camera_permission-473x1024]Telegram describes why it needs access to the camera At first glance, accelerometer data seems to be innocuous. It's only about moving and rotating the phone, right? Can that breach your privacy? The answer lies in the next section. Possible Scenarios Accelerometer measurements are collected all the time while you are holding your phone. iOS makes the measurements accessible to the app that is active in the foreground. The app may choose to ignore the measurements or read them. There're no boundaries for what an app can do with the measurements, but here are some spooky scenarios: Motion and Activities Accelerometer data reflects how you hold your phone and how you move. An app can tell if you are using it while lying, sitting, walking, or cycling. The app can also count your steps. Although access to the pedometer on the iPhone is protected by a system permission, there are many sophisticated algorithms that process accelerometer data to achieve exactly that. It is worth mentioning that the iPhone is also equipped with a barometer, a sensor that measures air pressure and altitude. The barometer is also part of the Core Motion Framework and no permission is required to access it. As a result, any app can figure out your altitude and measure air pressure in your environment. Thus, any app can tell if you are riding on a bus, train, or plane while using it. Heart Rate The accelerometer can detect the slight movements of your hand and body while holding the phone. Researchers can use this data to estimate your heart rate. Thus, an app can potentially know your heart rate while you are using it. Breathing Rate Similarly to heart rate, researchers can use accelerometer data to estimate your breathing rate, and even diagnose certain diseases. Precise Location Accelerometer data doesn't contain any location information. However, it can be used to infer your exact location based on the vibration pattern in your environment. To illustrate this concept, consider the following example: You are commuting to work by bus. While sitting on the bus, you open your favorite social app. Even though it is your favorite app, you don't trust it enough to share your location with it. At the next stop, a passenger gets on the bus. The passenger sits on the bus and opens the same social app. But the passenger shares their precise location with the app. Now, if this social app is reading accelerometer data on your phone as well as the passenger's phone, the app can easily figure out that both phones experience the same vibration pattern. Indeed, both phones are going to record the same vibrations, e.g. when the bus takes off, stops, and swerves left or right. The app now knows that you and the passenger are together in the same environment, hence same location. Don't be surprised if you receive a recommendation from the app to add this passenger as a friend. Audio Recorder Sound waves generated by your phone speakers cause the phone to vibrate. As every sound makes unique vibrations, researchers were able to analyze the vibrations and work their way backwards to reconstruct the original sound. So, if you are on a call and using the phone speaker, an app can pick up the vibrations generated by the speaker and recorded by the accelerometer. This way the app can record the call without having access to the microphone, albeit only the voice of your counterpart will be recorded. Any Examples? I tested several apps and checked if they read accelerometer data without a clear reason. Here are some examples: Facebook Facebook reads the accelerometer all the time. Facebook actually shows a support prompt if a shake event is detected across the app. This could be one reason why Facebook reads accelerometer data. The prompt has an option to switch this feature off. However, switching it off doesn't stop the app from reading the accelerometer. [IMG_2952-473x1024]Facebook shows a support prompt when a shake event is detected Instagram Instagram only reads the accelerometer in DM and keeps reading it as long as the user in the DM view. WhatsApp WhatsApp uses the accelerometer to add a motion effect to chat wallpapers. It is enabled by default, but you can switch this effect off in settings. The app stops reading the accelerometer when the effect is off. WhatsApp is mentioned here because it is a Facebook app. [IMG_0133-473x1024]WhatsApp uses the accelerometer to apply motion effect to wallpapers Other Apps The following apps didn't show any sign of reading the accelerometer for no clear reason: Facebook Messenger, Signal, Slack, Telegram, TikTok, Threema, Twitter, and WeChat. The next section will explain how you can find out the apps that read the accelerometer. A Little bit Technical As mentioned earlier, it is a bit hard for users to tell if an app is reading the accelerometer, but not for developers. I used the same method that I used before in our clipboard research. Xcode provides an option to view the system logs of the iPhone. To do that, you need to connect the iPhone to Xcode and open the iPhone console. The console displays a lot of log messages. To reduce the noise, type "accelerometer" in the search field. Now you only see processes, or apps, that read the accelerometer. The following screenshot shows the log messages displayed when Instagram reads the accelerometer. [Screen-Shot-2021-10-21-at-22]The log messages of Instagram while it is reading the accelerometer This video illustrates the process in action: Facebook reading the accelerometer Final Thoughts As of iOS 15, access to the accelerometer is open to all apps. Accelerometer data encompasses private information about you that any app can easily expose by applying the right algorithm. The rule of thumb in information security is that private information should be protected. Access to the accelerometer should be protected. App Versions App Version Facebook 340.0 Facebook Messenger 335.0.0.41.71 Instagram v210.0.0.16.67 Signal 5.22.1.3 Slack 21.10.20 Telegram 8.1.2 Threema 4.6.12 TikTok v21.5.0 Twitter 8.87 WeChat 8.0.15 WhatsApp 2.21.200.15 List of apps used in this study Further Reading * Jacob Leon Kroger, Philip Raschke, and Towhidur Rahman Bhuiyan. 2019. Privacy implications of accelerometer data: a review of possible inferences Posted byTommyOctober 24, 2021October 28, 2021Posted inSecurity Post navigation Previous Post Previous post: Exploring Tinder's new Block Contacts Feature Join the Conversation 1. [6e81943] 1 Comment 1. [6e81943]Jacob says: October 27, 2021 at 4:57 pm Really insightful, thanks for raising awareness! For those interested in further details, we have summarized the privacy impacts of accelerometer data in recent study: https://dl.acm.org /doi/pdf/10.1145/3309074.3309076 TL;DR - I have summarized the study in a Twitter thread: https://twitter.com/JL_Kroger/status/1420681035617116163) Reply Leave a comment Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] Comment [ ] Name * [ ] Email * [ ] Website [ ] [ ] Save my name, email, and website in this browser for the next time I comment. [Post Comment] Leave a comment If you like this work... Support us by downloading our apps at https://mysk.app Mysk, Proudly powered by WordPress. We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept", you consent to the use of ALL the cookies. Cookie settingsACCEPT Privacy & Cookies Policy Close Privacy Overview This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience. Necessary [*] Necessary Always Enabled Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information. Non-necessary [*] Non-necessary Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website. SAVE & ACCEPT