Coalition Against Stalkerware calls on Apple to mitigate abuse of WiFi Sync

UK cybersecurity firm Certo, a partner of the Coalition Against Stalkerware, has written a blog post about an iPhone feature that is being abused by stalkerware in a way that is hard to detect for the user.

Called ‘WiFi Sync’, the feature allows for a backup of phone data to regularly be downloaded onto a specific Windows or Mac computer when it’s on the same network as the phone. With so many valuable photos and messages being stored on people’s phones, such backups could give people a peace of mind.

However, the backup feature is being abused by stalkerware vendors who help abusers set up this feature to download data from the target phone to their own computer, assuming they regularly are on the same WiFi network. This is often the case if the abuser and the victim live together, but also if they regularly see each other, for example because they are co-parenting after breaking up.

Like most other kinds of stalkerware, this technique requires one-time access to an unlocked device, after which it works without any user interaction.

Installing stalkerware on an iPhone is a lot harder than on an Android device, as iPhones don’t allow ‘sideloading’: the installation of apps from outside the App Store. This is why stalkerware developers offer products for iPhones that instead use a backup of phone data, with this being the latest variant of this. And while unlike ‘regular’ stalkerware, backups aren’t created in real time, they contain a lot of very personal data, including photos, messages and browsing history.

Unfortunately, someone worried about their iPhone being surreptitiously set up for WiFi Sync can’t just check the settings on the phone: Apple removed visibility into WiFi Sync from the Settings in iOS 13, which was released in 2019.

Thankfully, Certo has created a free tool that allows you to quickly check your phone to see if it has been set up for WiFi Sync. We do, however, call on Apple to reinstate the feature in the Settings that gives visibility into the phone being set up for WiFi Sync.