21 Apr
2011
Researchers have discovered a secret database within iOS that store records of an iPhone user's location. Although this information is not transmitted to Apple, it is accessible through back-up files stored on a user's computer in iTunes. The database is unencrytped.
"Alasdair Allan, senior research fellow in astronomy at the University of Exeter, and writer Pete Warden, who discovered the log file and created a tool that lets users see a visualization of that data, say there's no evidence of that information being sent to Apple or anybody else. Even so, the pair note that the data is unencrypted, giving anyone with access to your phone or computer where backups may be stored a way to grab the data and extrapolate a person's whereabouts and routines."
Allan and Warden have made an open-source visualization program available for viewing location data stored in an iPhone or iTunes backup file -- however in the same manner that civilian GPS data is purposefully not as accurate as military data, the two researchers deliberately downgraded the accuracy of their program.
Although the database itself is unencrypted, iTunes does have an option to encrypt back-up files:
"To enable that feature, click on the device icon when it's plugged into iTunes, then check the 'Encrypt iPhone Backup' item in the 'Options' area. As for your iPhone, or iPad with 3G, your best bet is to keep someone else from getting it in the first place, and then using Apple's free 'Find My iPhone' app to do a remote wipe if it's lost or stolen."
Apple can collect this information legally according to the iTunes Terms and Conditions.
For a concise FAQ explaining the issues, check out the full story at CNET.