iPhone Apps, Including Facebook and TikTok, Exploit Notifications to Collect User Data: Study

In a recent finding, security researchers at Mysk Inc., an app development company, have disclosed that several widely used iPhone apps, including Facebook, LinkedIn, TikTok, and X/Twitter, are sidestepping Apple's privacy regulations to gather user data through notifications.

Despite users taking measures to close apps and prevent background data collection, these applications exploit notifications, evading protective measures.

The acquired data, unrelated to notification processing, is suspected to be employed for analytics, advertising, and cross-app user tracking.

Security experts are concerned about the apparent prevalence of this intrusive practice, even though some implicated companies dispute these findings, as per a Gizmodo report.

Tommy Mysk and Talal Haj Bakry, the researchers behind the tests, expressed astonishment at the widespread use of this data collection method.

(Photo: Ming Yeung/Getty Images)The iPhone 15 Pro Max in white titanium is seen from the left side with its new customizable button on display in the store on September 22, 2023, in Milan, Italy.

Apple Security Questioned

Contrary to denials by Meta and LinkedIn, researchers argue that this issue extends beyond specific apps, indicating a systemic problem within the iPhone ecosystem. This revelation aligns with Mysk's previous exposés, challenging Apple's claims of prioritizing user privacy.

The collected data seems to be employed in "fingerprinting," a method of identifying users based on seemingly harmless device details, a practice explicitly prohibited by Apple. This underscores the importance of user control through settings and rules.

In the case of Facebook, interacting with a notification allows the app to collect IP addresses, phone restart duration, and free memory space, facilitating precise user identification. LinkedIn, as per the tests, not only ensures notification functionality but also gathers data seemingly linked to advertising campaigns.

Despite Meta and LinkedIn asserting that the collected data is solely for improving user experiences and not shared externally, skeptics argue that such information, though less sensitive than location data, holds value for advertising purposes.

The forthcoming change in the iPhone operating system's rules, effective Spring 2024, mandates app developers to elucidate their usage of certain software pieces, known as "APIs." While this might encourage companies to disclose their data collection practices, concerns persist about Apple's enforcement of these rules.

Amid potential innocent explanations like outdated code, the researchers maintain skepticism, highlighting the need for heightened transparency and user protection. As privacy standards evolve, users are left questioning the extent of monitoring their digital activities for targeted advertising.

Safeguarding Your Private Data Online

Switching gears to safeguarding online data, employing a VPN service emerges as a highly efficient method. By allowing users to choose a server and location for an internet connection, VPNs utilize encryption protocols like OpenVPN and L2TP/IPSec, ensuring end-to-end encryption.

This not only secures data but also masks IP addresses, providing anonymity and access to geo-blocked content.

Another critical aspect is refraining from saving passwords in browsers, according to the National Cybersecurity Alliance. Disabling automatic password storage and opting for a reputable password manager that is compatible across devices ensures secure password management.

Additionally, an Aura article recommends regularly updating software and operating systems to address known vulnerabilities and enhance overall security, as highlighted in a 2021 Bitdefender report on Windows systems.