If you're an iPhone user in the European Union running the latest iOS version, you could be vulnerable to stealthy tracking due to a "catastrophic" flaw in Safari's implementation of alternative app stores, according to researchers.
The issue stems from Apple's new mechanism to comply with EU
laws requiring it to allow third-party app marketplaces on iOS. With iOS 17.4,
a "URI scheme" lets EU users easily install alternative store apps
from their website with a tap.
But iOS developers Talal Haj Bakry and Tommy Mysk revealed
this URI scheme opens the door to cross-site tracking and injection attacks
that put user privacy at risk.
"This makes the perfect recipe for a malicious
marketplace to be able to track users across different websites," the duo
warned.
Flawed Security Safeguards
At the core of the problem is a critical oversight in how
Safari handles URL checks for the alternative app store links. Rather than
strictly verifying if a website is an approved marketplace before invoking the
URI scheme, Safari will blindly accept any parameters once triggered.
This means a malicious actor could embed cleverly disguised
tracking pixels or scripts across the web. When an unwitting user taps the
seeming "install" button, Safari would fire off data to the
attacker's servers instead.
The researchers also found other vulnerabilities enabling
request hijacking and manipulation once the URI scheme initiates.
Apple Dropped the Ball on Privacy
While Apple has touted user privacy as a key selling point,
Bakry and Mysk argue these blatant security holes reveal a alarming lack of
foresight in the company's approach to third-party app stores.
"Apple must have forgotten that this is the web, and
developers can actually style HTML buttons to virtually look like
anything," they wrote.
They pointed out that Brave browser gets the implementation
right by properly checking website origins before allowing URI scheme
invocations. In contrast, "Apple finds it more important to check if the
scheme call came from an HTML button event than checking for cross-site
invocation."
The flaws are made worse by Apple's already questionable app
review process that has repeatedly failed to catch malware and scams on the
official App Store.
For now, the researchers strongly advise all EU iPhone users
to switch to Brave or other secure browsers to avoid the Safari tracking
vulnerabilities. They also plan to investigate if similar risks exist when the
iPad inevitably adopts the same app sideloading policies soon.
Push for Control Backfires
Ultimately, the researchers believe Apple's insistence on
controlling sideloaded app distribution, rather than an open approach, opened
this entire security can of worms.
The push for tighter regulation and interoperability was
meant to foster more open mobile ecosystems and increase consumer choice. But
in trying to maintain its historically closed model, Apple may have
inadvertently created an even bigger privacy nightmare for its European user
base.
With significant backlash already growing, it will be
fascinating to see how - or if - the tech giant properly addresses these URI
scheme vulnerabilities going forward. For now, EU iPhone owners have good
reason to remain extremely cautious when dealing with any alternative app
stores on mobile Safari.