Apple Patches iOS Bug That Let Apps Eavesdrop on Your Siri Conversations

iOS developer and 9to5Mac writer Guilherme Rambo on Wednesday shared details of a now-patched bug he discovered that let apps listen in on and record whatever iPhone users said to Siri or the iOS keyboard’s Dictation feature while using AirPods or Beats headphones.

SiriSpy – iOS bug allowed apps to eavesdrop on your conversations with Siri https://t.co/Lmi5e8fqJc

— Guilherme Rambo (@_inside) October 26, 2022

The bug gave apps access to the user’s microphone without their permission. It was caused by a security hole in Apple’s TCC (Transparency, Consent, and Control) system, which is what makes apps ask for user permission before accessing your location, calendar, microphone, camera, etc.

Any app with access to Bluetooth could record your conversations with Siri and audio from the iOS keyboard dictation feature when using AirPods or Beats headsets. This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone.

Rambo stumbled upon the bug in late August while tinkering around with a command-line tool he created to help with his work on AirBuddy, an AirPods companion app for Mac.

The developer found that the DoAP service, used on AirPods and Beats for Siri and Dictation support, could collect audio data while the user talked to either of those features — all without asking the user or leaving no evidence of what it was doing.

Rambo created an app, aptly coined “SiriSpy,” to see if this bug could be exploited. His app was able to:

• Ask for Bluetooth permission
• Find a connected Bluetooth LE device that has the DoAP service
• Subscribe to its characteristics to be notified of when streaming starts and stops, and when audio data comes in
• When streaming starts, create a new .wav file and then feed the Opus packets coming from the AirPods (or other Bluetooth LE device) into a decoder, which would then write the uncompressed audio to the file .wav file.
• Once streaming stops, close the .wav file and send a local push notification to demonstrate that it has successfully recorded the user in the background.

You can watch SiriSpy in action over on Rambo’s blog.

“In a real-world exploit scenario, an app that already has Bluetooth permission for some other reason could be doing this without any indication to the user that it’s going on, because there’s no request to access the microphone, and the indication in Control Center only lists ‘Siri & Dictation’, not the app that was bypassing the microphone permission by talking directly to the AirPods over Bluetooth LE,”  the developer explained.

Rambo was able to confirm that the bug was present on both the shipping version of iOS 15 and the latest iOS 16 beta at the time, as well as other Apple platforms. He informed Apple’s security team of his discovery on August 26.

Apple has deployed a fix to this vulnerability in iOS 16.1, which started rolling out on Monday, and the rest of its operating systems. This bug was being tracked as CVE-2022-32946.

Apple awarded Rambo a $7,000 USD bug bounty for his efforts. The developer said on Twitter that has was “expecting a bit more,” which isn’t entirely unreasonable considering he reported a bug that could have given apps free rein over anything iPhone users said to Siri or Dictation.