Hasta La Gadget!

An unencrypted file stored in iPhones and iPads constantly records a user's location data. An open source application was used to plot the location data from an iPhone belonging to a Wired.com reporter.

Your iPhone or 3G-equipped iPad has been secretly recording your location for the past 10 months.

Wired.com can confirm that fact: The screengrab above shows a map containing drop pins of everywhere yours truly has been in the past year.

Software hackers Peter Warden and Alasdair Allen discovered an unencrypted file inside Apple’s iOS 4 software, storing a long list of locations accompanied with time stamps. The file is labeled “consolidated.db.”

“Ever since iOS 4 arrived, your device has been storing a long list of locations and time stamps,” Warden and Allen wrote. “We’re not sure why Apple is gathering this data, but it’s clearly intentional, as the database is being restored across backups, and even device migrations.”

Warden is providing an open source program “iPhone Tracker” for iPhone and 3G iPad customers to output their location file into an interactive map, like the one above, so they can see for themselves. All you have to do is plug in your iDevice through USB and run Warden’s application. The software requires OS X 10.6 (Snow Leopard).

The iPhoneTracker application features a sliding bar for users to see where they were in specific times of the year.

Apple did not immediately respond to a request for a comment. Apple has not previously disclosed that iPhones and iPads are constantly tracking and storing user location.

The discovery is the latest in a series of alarming incidents that serve as cautionary tales about privacy in the always-connected mobile era.

Recently, German politician and privacy advocate Malte Spitz sued his phone carrier Deutsche Telekom to get every piece of information it had about him. The carrier delivered to him a gigantic file containing 35,000 data points of his location for six months. Later, a German publication plotted Spitz’s data onto an interactive map.

This iPhone and iPad privacy leak is eerily similar, and creepier, considering that Apple has sold over 100 million iPhones and 15 million iPads.

The location data stored inside “consolidated.db” cannot be accessed by Safari or any apps, said Charlie Miller, a security researcher known for discovering vulnerabilities in the iPhone. However, the data file is sensitive because a thief who gains physical access to an iPhone or iPad could look at the file and see everywhere a customer has been, or a hacker could remotely break in and read the file, Miller said.

It’s not simple for a hacker to remotely access an iPhone to get to that file. But in the past, Miller found an exploit that would allow a hacker to hijack an iPhone just by sending a text message to it containing malicious code. Apple later patched that exploit, but security researchers say there are plenty of vulnerabilities in the wild left unaddressed.

Sharon Nissim, consumer privacy counsel of the Electronic Privacy Information Center, said it is possible Apple is violating the Wireless Communications and Public Safety Act, which allows telecom carriers to provide call information only in emergency situations.

“By asking for permission to collect location data, Apple may be trying to get around its legal obligations, by asking people to give up privacy rights they don’t even know they have,” Nissim said.

She added that a potential privacy concern is that law enforcement would be able to subpoena these types of records from people’s iPhones or iPads.

See Also:

• IPhone Can Take Screenshots of Anything You Do
• iPhone or iSpy? Feds, Lawyers Tackle Mobile Privacy
• Hacker Resolves iPhone Screenshot Security Issue

Along with the Motorola Atrix, LG’s G2X is one of the first dual-core smartphones powered by Nvidia’s Tegra 2 processor to hit the market. Our first impression after getting our hands on it: Two cores really are better than one.

As soon as we picked the phone up and started scrolling through the app menus, the phone’s speed was immediately noticeable. Switching back and forth between different menu screens was speedier than ever. Playing the Halo-like pre-loaded app “Nova” was a super smooth experience, as the game ran with minimal choppiness while handling some fairly intense animations.

What’s worrisome, however, is the relatively small amount of RAM that comes in the G2X. With such a powerful processor under the hood, we’re a bit surprised the phone only comes with 512 MB of RAM installed. That might not prove to be enough for future resource-hungry apps and games. For now though, the phone ran the games we played like a charm.

Instead of rolling its own custom user interface, LG went with a stock version of Android 2.2 (Froyo) for the G2X. Frankly, not having to deal with another manufacturer’s skin is a big plus for us: Interfaces like HTC’s Sense or Motoblur just feel chunky compared to the bare-bones version of the OS. And although it’s not running the latest version of Android (Gingerbread) quite yet, it’s slated to receive the OS update sometime this summer.

The 4-inch capacitive touch screen displays color brilliantly, and the 8-megapixel back facing camera takes some of the best camera phone shots we’ve seen yet (not to mention that 8 megapixels is one of the highest smartphone camera resolutions on the market now). A 1.3-megapixel front facing camera comes ready for video chat using T-Mobile’s QikTM app.

HDMI output on the phone allows you to connect it to a flatscreen, so you can watch 1080p video from your phone. The camcorder also supports 1080p video recording, and DLNA means wireless playback on compatible devices.

The phone comes with 8 GB of internal storage (a relatively small amount if you’ve got a big music library), upgradable to 32 GB via microSD card slot.

An interesting quirk: the phone’s power button is on the right-hand side of the top edge. If you’re right handed like I am, it can be a bit disorienting to reach for a button on the left-hand side that just isn’t there.

T-Mobile’s network performance on the phone was adequate, though left us wanting. T-Mobile markets its HSPA+ as “4G” — a term which has grown murkier in the recent past — with “theoretical peak download speeds reaching 21 Mbps and peak upload speeds of up to 5.7 Mbps.” Our average over two days of testing in the San Francisco Bay Area was significantly less than that optimistic “theoretical peak,” with download speeds in the 3.5 to 5.5 Mbps range, and upload speeds anywhere from 0.2 Mbps to 1.8 Mbps. 4G coverage was spotty at best outside of San Francisco proper, and the phone dropped two of the ten or so calls I made over the weekend.

Dual-core processors are hot this year. Motorola’s Atrix was the first to drop in February, and HTC’s dual-core Sensation 4G is scheduled for a mid-May release in the U.K. And as recently as last week, reports suggest that Samsung may produce a dual-core smartphone offering by next year.

Will the dual-core trend continue? If the speed of the LG G2X is any indication, we sure think so.

See Also:

• Hands-On With LG's Optimus 2X Superphone
• Rumor: Google and LG to Team Up on Android Nexus Tablet
• LG Crams Android Into 'Smarter' Home Appliances
• Intel, LG Partner To Create New Mobile Internet Device

WP7-installed mobile devices are subjected to automated testing cycles. Photo: Mike Kane/Wired.com

Microsoft’s new Windows phone platform hasn’t gained much momentum in the market, but the company is rapidly revising the operating system in an effort to catch up with rivals.

The company on Wednesday at its MIX developer conference detailed the upcoming software update for Windows Phone 7, dubbed “Mango,” due for release this fall.

The software update will be compatible with all smartphones running Windows Phone 7. Microsoft’s new OS is available on some smartphones from hardware partners including LG, Samsung, HTC and Dell.

Microsoft’s Windows Phone 7 is the software giant’s complete do-over on a mobile OS, after its predecessor, Windows Mobile, took a big hit in market share in the wake of Apple’s iPhone and Android-powered smartphones.

Notably, the Mango update will introduce multitasking for background processing, file transfers and fast app switching, similar to Apple’s iOS multitasking.

Also, third-party apps will be able to take advantage of some of the sensors inside Windows Phone 7-powered hardware, including the camera and motion sensors, for programmers to create augmented-reality applications. Some other core features of Windows Phone 7 include copy and paste and multimedia messaging.

“The next release of Windows Phone represents the evolution of our strategy for ensuring that developers are at the forefront of ‘what’s next’ by investing in even richer customer experiences, a powerful application platform and a thriving ecosystem,” said Joe Belfiore, corporate vice president of Windows Phone, in a statement.

Indubitably, Apple and Google will continue issuing software updates for their mobile operating systems too. But it’s worth noting that copy and paste didn’t appear on Apple’s iPhone until version 3.0, and multitasking and fast-app switching came in version 4.0. Windows Phone 7 has only been on the market since November 2010, and it’s going to be delivering all those features after less than a year.

The nimble pace of Windows phone upgrades shows how seriously Microsoft is investing in the new Windows Phone 7 platform, despite its paltry sales estimates. That intensity may be partly spurred by anticipation of its impending partnership with Nokia.

Microsoft and Nokia recently announced their plans to sell Windows Phone 7-powered Nokia phones together. Given Nokia’s position as the world’s largest cellphone manufacturer, this partnership should provide a significant springboard for Windows Phone 7 to gain presence worldwide.

The first Nokia Windows phones won’t ship until 2012, and at the pace Microsoft is moving with Windows Phone updates, it will be interesting to see how much the mobile space changes once that partnership comes into fruition. Research firm IDC predicts that Windows Phone 7 will be the No. 2 player in the smartphone market by 2015.

See Also:

• Microsoft Patching Up Windows Phone 7’s Ragged Update Process …
• Windows Phone 7 Update Adds Multitasking, New Internet Explorer …
• Why Windows Phone 7 Will Make Android Look Chaotic
• How Microsoft Hit CTRL+ALT+DEL on Windows Phone

“Windows Phone 7 is the most aggressively different, fresh approach to a phone interface since the iPhone.” We published those words half a year ago, hoping WP7 would be a radical firebrand in phone land. But it’s stalled. We’re disappointed. More »

Some iPhone apps ask you for permission to track your geographical location. However, some apps pull such data without your approval. Photo: Jon Snyder/Wired.com

If people want to know everything about you, they need look no further than your smartphone. It contains a host of your personal information and leaves a trail of digital footprints everywhere you go.

A proposed class-action lawsuit filed last week alleges that Apple and a handful of app makers are invading user privacy by accessing personal data from customers’ smartphones without permission and sharing it with third-party advertisers.

Concurrently, federal prosecutors in New Jersey are investigating whether several smartphone app makers, including Pandora, are transmitting customer information without proper disclosure. Separately, Congress is mulling legislation aimed at giving consumers the option to tell companies not to track their personal data.

“I’m glad this is coming to light, because I think consumers are waking up to the tracking that’s going on with a computer, but I think there’s an extreme lack of knowledge about the tracking on your iPhone or your iPad,” said Sharon Nissim, consumer privacy counsel of the Electronic Privacy Information Center, which is not involved in the lawsuit.

Plaintiffs Natasha Acosta and Dolma Acevedo-Crespo on April 7 filed a civil complaint against Apple and eight companies providing iPhone or iPad apps, accusing them of violating the Computer Fraud and Abuse Act by intentionally accessing customer information without their authorization. The complaint seeks class-action status on behalf of every iPhone or iPad user who has installed one of the defendant’s apps over the last four years.

Well-known apps named in the lawsuit, which was filed in the district of Puerto Rico, include music-streaming service Pandora, and Dictionary.com.

The complaint accuses both Dictionary.com and Pandora [.pdf] of sharing an iPhone user’s unique device identifier, age, gender and location with third parties, including advertisers. Neither Pandora nor Dictionary.com are services that rely on location, the complaint notes.

The lawsuit cites as evidence an ongoing independent investigation by The Wall Street Journal, which tested 101 apps and found that 56 transmitted the phone’s UDID to third parties without user awareness or consent.

An iPhone does not transmit a customer’s real name, but Apple and third-party apps can identify a device with a string of unique numbers, known as the unique device identifier (UDID).

The problem is, with a UDID and other personal information such as location, age and gender data, a company could easily piece together the real identity of a smartphone user and sell that information to marketers, explained John Nevares, a lawyer representing the class-action complaint.

“When you put those together they’re able to transfer to a third party all your personal information so they can contact you later on and try to sell you something,” Nevares said. He added that this type of activity constitutes fraud and deceptive practices.

EPIC’s Nissim echoed Nevares’ concerns.

“There hasn’t been a lot of recognition that that type of identified number should be treated as personally identifiable information,” Nissim said. “If it’s combined with other information it could be used to identify you, and it becomes a gold mine of data for advertisers.”

Also as a result of The Wall Street Journal’s investigation, a federal grand jury has issued subpoenas to multiple iPhone and Android app makers, including Pandora and Anthony Campiti, creator of the Pumpkin Maker iPhone app. Pumpkin Maker, which is also named in the New Zealand class-action complaint, is an app that allows customers to carve virtual jack-o’-lanterns. The WSJ found that this app shares UDID and location data with advertisers.

The federal investigation is significant, because it could result in criminal charges against companies accused of committing fraud, the WSJ notes. However, it’s rare that companies get charged with criminal offenses, so the investigation may evolve into a civil issue, meaning companies could be forced to pay monetary damages and promise to cease these practices.

“They’re just doing information-gathering to get a better understanding” of the industry, Campiti told WSJ. “We’re not doing anything wrong and neither is anyone else doing anything wrong.”

Apple declined to comment on this story.

However, an Apple spokeswoman referred Wired.com to Apple’s privacy policy, which states, “We may collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where an Apple product is used so that we can better understand customer behavior and improve our products, services, and advertising.”

Issues of mobile privacy are not unique to the United States. In Germany, politician and privacy advocate Malte Spitz sued his carrier, Deutsche Telekom, to get all the information it had on him.

The telecom giant handed over to Spitz a gigantic file revealing it had tracked him 35,000 times between August 2009 and February 2010 — enough data points for German newspaper Die Zeit to compile an interactive map and video tracking his every move for six months.

In response to the Spitz incident, two U.S. Congressmen are urging American phone companies AT&T, Verizon, Sprint and T-Mobile to disclose their data collection practices.

See Also:

• Google Privacy Practices Worse Than ISP Snooping, AT&T Charges
• Learn About Privacy Issues in Networked: Carabella on the Run
• How to Handle Facebook Privacy Settings for Your Kids