Analytics services at the heart of new privacy violation

Feb 7, 2019 09:49 GMT  ·  By

The analytics services that several popular iOS applications are currently using power actions like screen recording without user knowledge, according to a recent discovery.

The software created by Glassbox is being used to capture user activity within apps, including taps and swipes, but also to record what’s happening on the screen for more in-depth analytics.

A report from TechCrunch reveals that several popular apps available on iOS bundle these services, including Air Canada, Expedia, Singapore Airlines, and Hotels.com.

The Glassbox software uses a feature called session replay, which makes it possible for developers to take screenshots or even create a recording of the user activity. The data is supposed to be used for analytics, as developers can determine the way people use their apps.

But as the cited source notes, there are apps that expose additional information, including password numbers and credit card information. Air Canada’s official app is one of those potentially failing to secure the data, and it’s believed that many more could expose sensitive details, like email addresses.

Apple tight-lipped on this discovery

Given this information is sent to Glassbox servers, there are concerns that it could be accessed as it leaves your device, possibly leading to unauthorized use of data, as in the case of passwords and banking credentials.

The worst thing is that the apps do not clearly state that the screen could be recorded and require permissions to do so. However, Glassbox says the SDK available for developers “cannot break the boundary of the app,” which means they can’t access any information from outside the app.

In an official statement, a company spokesperson pointed to a keyboard app, which although it covers certain applications, it doesn’t provide access to its customers to see logged data.

Apple hasn’t released any comment on this new privacy concern, and all the applications that are believed to bundle this behavior are still available for download from the App Store.

You can see the full list of Glassbox customers in the box after the jump.

Glassbox Customers