Apple: Mysterious iPhone 11 location pings were because of 'ultra-wideband compliance'

For a company that prizes itself on its privacy credentials, Apple received a bit of a bloody nose earlier this week when long-time security journalist Brian Krebs revealed the iPhone 11 Pro intermittently seeks the user’s location — even when there are no applications with location permissions in use. In recent years, Apple …

[Anonymous Coward]

Damn guilds!

"... awfully strange that Apple took the best part of the week to confirm this."

Tim here,

Well... you got to hire these writers man that are guilded, have unions, agents etc... it's a pain. You can take a risky approach and send out a company wide email looking for under grades with creative writing experience, but that usually turns into a "reimagining" of Fear and Loathing in Las Vegas with a touch of Twin Peaks, so you're kinda of cornered by time on spinning an excuse once you're caught red handed. Honestly, just put the blame on the user for whatever the problem might be, in this case, for physically moving with the phone. It, it, it's just too much... just make them go away.

[Anonymous Coward]

You're holding it wrong.

[Rameses Niblick the Third Kerplunk Kerplunk Whoops Where's My Thribble?]

You're holding it wrong.

It's not so much the holding that's the issue, it's more a case of "you're moving it wrong". Not at all a limitation in a mobile device, by the way.

[headrush]

Does this mean that every known location where ultra-wideband is prohibited is stored on the device? Sounds improbable, meaning there must be comms between the device and a db server at least.

[Anonymous Coward]

If I can download the entire (OSMAnd) map of the country to the internal storage of my five-year-old mid-range phone, I don't think even tens of thousands of polygons representing no-UWB zones are going to bust an iPhone's memory banks.

[doublelayer]

The regulation document linked seems to imply that most of these regulations occur at a per-country level. A database of country name and a set of parameters would take up fifty kilobytes if using a verbose XML format, and in a compressed format would fit nicely into this comments box. I only read a bit of the document, so it's possible there are other places, such as military bases or communications testing labs, near which UWB isn't allowed. Even given that possibility, a list of coordinates and distance ranges would be really small.

If the issue is only what country the device is located in, however, that information is likely available from the mobile network without requesting location data from the towers. While there is some possibility that someone is very close to the border with another country and their network thinks they're in another one, that strikes me as somewhat unlikely.

[A.P. Veening]

While there is some possibility that someone is very close to the border with another country and their network thinks they're in another one, that strikes me as somewhat unlikely.

That is a daily occurrence for lots of people living close to borders. Luckily the (financial) consequences of that problem have been eliminated within the EU.

[Anonymous Coward]

For regulatory purposes, you'd probably err on the side of caution. Meaning that if you live a quarter mile from the border of a country where UWB is banned, you might not be able to use it in your house.

[doublelayer]

I had assumed that anyone living so close to a border would have worries about the financial problems with jumping from one country's provider to another, and would have disabled their roaming or at least customized it not to roam to the nearby provider. Therefore, the provider actually giving service to their device would be the one from their country and that information could be used to determine what restrictions there are on UWB usage. Perhaps that was an overeager assumption, but I'm still not sure how much precision Apple needs for determining available UWB settings.

[Packet]

Fix the headline please...

it's not ios 11 (that came out in 2017) but the iphone 11

[Anonymous Coward]

Re: Fix the headline please...

Well, didn't the current iPhone got out in 2017, with only cosmetics changes and price increase since?

[hellwig]

Currently no option to disable it?

Apple: UWB is heavily regulated, you can't just use it everywhere.

User: Well, then can I just turn it off? I don't need it.

Apple: Huh, hadn't considered that.

[fidodogbreath]

Re: Currently no option to disable it?

Apple: Huh, hadn't considered that.

Given the track record of the aptly-numbered iOS 13, it's probably for the best that they didn't try to cram in "one more thing."

[Pascal Monett]

"We do not see any actual security implications,"

Well what if a security researcher does ?

Personally, if I have not activated location services, I expect my phone to not activate them on its own.

I am sick and tired of devices that do their own thing independently of what I actually told them to do.

Another reason for me not to buy Apple - not that I'm lacking any.

[fidodogbreath]

Re: "We do not see any actual security implications,"

You're aware that your cellular provider can geolocate you at any time, right?

[Zippy´s Sausage Factory]

Re: "We do not see any actual security implications,"

But that's a different thing from that information is floating about in the phone memory, waiting for Facebook or other malware to misuse it...

[Anonymous Coward]

Re: "We do not see any actual security implications,"

Facebook has to have its access to location enabled for it to get it. It can't just root around in RAM wherever it wants and find it.

[Anonymous Coward]

Re: "We do not see any actual security implications,"

Are 100% sure of that?

[ThomH]

Re: "We do not see any actual security implications,"

If you don’t trust separation of processes then you should first decline to use any sort of online banking or commerce — stealing your credit card number is more easily valuable than stealing your location, and is therefore of interest to a greater number of malicious actors.

When you’ve passed that level of paranoia, then it may be appropriate to worry about this sort of unshared location information.

And after that, you might wonder whether it’s actually safe ever to type a password in to anything. And if you don’t trust your phone to hide data behind a password, whether you can use one at all.

[tiggity]

Re: "We do not see any actual security implications,"

"If you don’t trust separation of processes then you should first decline to use any sort of online banking or commerce — stealing your credit card number is more easily valuable than stealing your location"

I (and lots of others) never buy anything using their phone as it is difficult to make a phone secure enough.

The added irony that if you root it (for full control of whats installed (removal of "system" level pre installed junk that is not user removable otherwise) , set up decent firewalls etc) then most bank apps refuse to run as detect phone is rooted.

[Anonymous Coward]

Re: "We do not see any actual security implications,"

That's how it is supposed to work. Obviously where complex software is concerned bugs are always possible, but when they are found Apple is very quick to release fixes and the support all the hardware sold in the past half decade and in some cases even older.

[JohnFen]

Re: "We do not see any actual security implications,"

Of course they can, but I don't see how that's relevant. That there's a security concern from one vector doesn't make it OK to have security problems from other vectors.

[Anonymous Coward]

Re: "We do not see any actual security implications,"

"Another reason for me not to buy Apple - not that I'm lacking any."

Yes, because stock Android is so much better, where even if you turn off all location services, it STILL sends location data to Google? When grilled about this in Congress, a Google rep had the cojones to lie and say that it's required for the phone to actually work!

Granted, if you go with LineageOS and don't install ANY Google frameworks you're mostly fine, although it still requires modifications to the kernel as the stock ASOP kernel even has location snooping built into it!

[Anonymous Coward]

The security researcher noted location info was being gathered

He didn't know what was happening to it. Now he knows, and since that gathering of it never leaves the phone then there are no privacy implications.

That said, Apple's failing wasn't in making it clear that the toggles for system services use of location information were the only ones where location information might leave the phone. The purpose of Apple adding the little arrow when location information was being accessed was to let people know that their location information was being gathered and might leave the phone. When it is being gathered by the system for something where it won't leave the phone, the arrow probably shouldn't appear.

[JohnFen]

I'm actually surprised

Given that Apple is so vocal about privacy and security, I'm very surprised that they'd roll this out without allowing users to disable it. I'm even more surprised that Apple said that they don't see the very obvious security/privacy problems with having it enabled.

[Anonymous Coward]

Re: I'm actually surprised

Why would you need to disable it, when the location information doesn't leave the phone? There's no privacy implication in this case.

They REALLY should have had a toggle for UWB at launch though - given all the FUD around 5G causing cancer I can imagine if those same people claiming that found out iPhone 11 could broadcast something as scary sounding as "ultra wide band" they'd boycott it immediately!

[Anonymous Coward]

Re: I'm actually surprised

>no privacy implication

Yeah, other than your phone recording your every move, and you trusting Apple to not exfilitrate it.

[JohnFen]

Re: I'm actually surprised

"Why would you need to disable it, when the location information doesn't leave the phone? There's no privacy implication in this case."

If my phone is sending out a signal, there's privacy implications. With this, for example, everyone near me with a similarly capable phone will know that I am nearby and have such a phone.

[Anonymous Coward]

In other news

Apple is being sued by a Chicago Law Firm over supposed illegal radiation being emitted by all iPhones.

How many lawsuits are Apple fighting these days? 1000? More?

Got any APPL stock? Perhaps it is time to sell?

[doublelayer]

Re: In other news

Every large company will be sued by lots of people. Some with real concerns for which the company should (but probably won't) pay through the nose. Some with concerns that are valid but rather minor. Some with concerns that were valid but everybody's forgotten about them and they no longer exist. And some from people who want money, have identified a possible source, and are willing to try anything they can think of to get some because their time must be really cheap. I think you'll find that with many companies, and unless a specific case looks very damning or the company can't handle it, don't expect that to affect the stock price very much.

[Anonymous Coward]

Re: In other news

Samsung is being sued too.

You don't find it a bit suspicious that by far the two market leaders in the US are being sued in the US? The FCC sets the standards by which phone OEMs do their radiation measurements. If Apple and Samsung have satisfied the FCC, this lawsuit has nothing to stand on. Just ambulance chasers going where the billions are hoping for a settlement to make them go away.

[Mike 16]

Ultra Wide Band

You mean like the spark-gap transmitter on Titanic?

[Anonymous Coward]

So turn off Location Services then?

Unfortunately with Android this is not an option.