9

I was reading about a missed call scam just now where the user gets charged even if they don't call the number back. It occurred to me that a malicious iPhone app could make calls to premium numbers to scam users out of money - indeed, it appears this has happened in the past.

According to Apple's own documentation:

When a user taps a telephone link in a webpage, iOS displays an alert asking if the user really wants to dial the phone number and initiates dialing if the user accepts. When a user opens a URL with the tel scheme in a native app, iOS does not display an alert and initiates dialing without further prompting the user.

It seems to me that an apparently benign iPhone app could, say, wait until the phone was left on charge (and hence likely not being attended by the user) and then initiate a call to a premium rate number to net the developer a tidy bonus. There doesn't appear to be any permission in iOS I can change to prevent this behaviour, since this is opening the phone app with a URL rather than accessing any phone data.

Can anyone confirm if my understanding is correct and, if so, why on earth Apple haven't closed such a gaping hole?

Improve this question

3 Answers 3

Reset to default
10

I've experimentally checked the iOS behavior by trying to initiate a phone call from one of my apps.

Here are the results:

  • It is possible to programatically start a phone call without user confirmation. I've just written a single line of code that is executed right after the App has been loaded. Meaning that if your App is in the foreground it can start a call at anytime, even without needing user to tap anywhere.
  • I've sent a silent remote push notification to the App in order to wake it app if it is not running, and then execute the same code. No call was started; iOS does not allow an app to initiate a phone call if the app is running in the background.

So answering your questions, the only way to start a phone call without the user noticing it, is by somehow convincing the user to leave the malicious application running in the foreground, and then start the phone call, as iOS won't allow this operation if the app is backgrounded.

Currently iOS does not provide any mechanism to block starting phone calls from a particular app, but it can only happen if the app is in the foreground.

Improve this answer
1
  • Thanks for the comprehensive investigation, brilliant answer. I'm glad to hear it's only in the foreground, although I can't help but think it's not too hard to invent an app which is likely to be left unattended and in the foreground - the camera app doing a time-lapse is a good example of the type of thing. I'd still prefer opening URLs in other apps was a permission for each other app opened - just confirmed the first time per external app, not every time. I do accept that has UX implications, however. I guess everyone just has to be vigilant.
    – Cartroo
    Apr 30, 2016 at 7:18
5

I've made a test app to check this. App can open URL such as tel://123456789 only when it is in foreground and active. When I call this code even just after entering the background state, the API to open this URL did nothing. So to answer your question - apps won't be able to make a call without your knowledge.

To test this paste this in your AppDelegate:

- (void)applicationDidEnterBackground:(UIApplication *)application {
   [[UIApplication sharedApplication] openURL:[NSURL URLWithString:@"tel://123456789"]];
}
Improve this answer
1
  • Great answer, thanks for the code. If I could accept both answers I would.
    – Cartroo
    Apr 30, 2016 at 7:18
2

When trying to initiate a call on iOS >= 10.3, a popup will always be displayed to the user. Docs

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .