Apple customers can sync a lot of the data on their devices to iCloud, but some information is being backed up in a way they might not be aware of and can’t control: their iPhone call logs.
Moscow-based digital forensics firm ElcomSoft reported yesterday that it discovered Apple was automatically uploading iPhone call logs into iCloud for users running iOS 8 and up on their devices. What’s more, users have “no official way” to turn off those backups, which include information about incoming, outgoing, missed and rejected calls, according to the company.
ElcomSoft said the discovery has implications for the privacy of iPhone users. Apple has publicly fought law enforcement efforts to unlock iPhones connected to investigations, noting that it does not have access to customer passcodes that would allow it to do so. However, user data stored in iCloud is easier for third parties — whether law enforcement or hackers — to access.
Only Fix ‘Greatly Affects’ Usability
In its announcement yesterday, ElcomSoft said that Apple could store iPhone call logs on its servers for months. The company added that the only way that users can disable the syncing feature is by disabling iCloud completely on their devices, which would greatly affect usability.
“Automatic cloud sync of call logs is great if you know about it and have an option to shut it off,” ElcomSoft CEO Vladimir Katalov said in a statement. “While Apple works hard to improve security of their physical devices, they move more and more data into the cloud where law enforcement can easily obtain it.”
In a blog post about the discovery yesterday, ElcomSoft’s Oleg Afonin added that iCloud data is “very loosely protected, allowing Apple itself or any third party with access to proper credentials extracting this information. Information stored in Apple iCloud is of course available to law enforcement.”
Apple’s Privacy Battles
Since the rollout of iOS 8 in September 2014, Apple devices running that operating system and later versions have been encrypted by default. That means only the owner — and not Apple — has the passcode to unlock the device.
Just a few months after the release of iOS 8, Apple’s stance on customer privacy became the focus of a hard-fought legal battle with the Federal Bureau of Investigation. Following a mass shooting in San Bernardino, Calif., in December 2014, the FBI sought to force Apple to help it unlock an iPhone that had been used by one of the shooters. However, Apple fought that effort in court, contending that the request to create an “FBiOS” could leave millions of its other customers’ devices vulnerable to hacking.
The FBI eventually turned to a third part that unlocked the iPhone in question without Apple’s help. However, officials still want Apple to help them unlock numerous other phones connected to state and federal investigations.
In its legal process guidelines, Apple said it “does not have access to a user’s passcode but, depending on the version of iOS that the device is running, may be able to extract some data from a passcode locked iOS device running iOS 4 through iOS 7 with a valid search warrant.”
Afonin noted yesterday that iPhone users have reported other problems with syncing, such as receiving missed call notifications for a spouse’s phone using the same Apple ID.
A user with more than one iPhone should “consider disabling iCloud Drive on one device (don’t mix it up with iCloud; iCloud Drive is available elsewhere and can be disabled separately from iCloud),” Afonin said. “This way you’ll prevent call sync without affecting things such as iCloud Photo Library or iCloud backups. You will, however, lose the ability to sync data across third-party apps that may use iCloud Drive to save their data.”
