Thread by @mysk_co

We prepared this video to illustrate why access to the accelerometer should get a permission in iOS. Unrestricted access to accelerometer data can breach user privacy. We used Facebook as an example in the video.

#Cybersecurity #Privacy #iOS

It's amazing what algorithms can extract from accelerometer data:
- Detect if you're walking, sitting, cycling.. etc
- Count your steps
- Figure your heart rate
- Find your precise location
- Analyze sound vibrations of your phone speaker and infer what you're listening to

The iPhone is equipped with a very accurate accelerometer. It helps algorithms achieve their goals with high accuracy.
Good news: iOS only allows apps to access the accelerometer when apps are active in the foreground

Bad news: apps can access the accelerometer without any system permission and without the user being aware.
Well, what could go wrong with that, it's only accelerometer data?
Here's why you should care:

As shown in the video, Facebook reads accelerometer data all the time. If you don't allow Facebook access to your location, the app can still infer your exact location only by grouping you with users matching the same vibration pattern that your phone accelerometer records

For example, if you are on the bus and a passenger is sharing their precise location with Facebook, Facebook can easily tell that you are in the same location as the passenger. Both vibration patterns are going to be identical, e.g. the bus suddenly stops or takes off.

More examples: this research shows that phone speaker vibrations can be detected by the accelerometer and then further algorithms can be applied to reconstruct the speech:

arxiv.org/pdf/1907.05972…

And this research applies algorithms to predict heart rate by analyzing and processing accelerometer data:
venturebeat.com/2018/07/13/res…

In addition, there are many github projects that implement sophisticated methods to count steps based on accelerometer readings:
github.com/bagilevi/andro…