Jump to content
Sign in to follow this  

Apple is storing your 'deleted' Safari search history in iCloud

Recommended Posts

Apple is storing your 'deleted' Safari search history in iCloud



Researchers find iCloud storing Safari history & Google search data for years, Apple now deletes data older than 2 weeks
Security researchers at Elcomsoft, have discovered that Apple has been storing users’ Safari browsing histories in iCloud for extended periods of time, Forbes reports. 
Elcomsoft CEO Vladimir Katalov, who also discovered last November that Apple was storing iPhone call logs in iCloud, told Forbes that data stored in iCloud for syncing web browsing history and related data across iOS and macOS devices is actually retained in separate “tombstone” records even after browsing history entries have been “cleared” from Safari.
Katalov indicated he came across the issue by accident when testing one of his company’s forensic tools to compare data extracted from an iPhone to the data from that iPhone has linked iCloud account. According to Katalov, these records “stay in the cloud probably forever.”
Forbes was also able to verify these claims using Safari 10.0.2 and Elcomsoft’s “Phone Breaker” tool, discovering nearly 7,000 “deleted” records going back for over a year.
Additional data such as the number of time a site had been visited as well as the date and time the item was deleted. 
The report acknowledges that while it is unclear why this data is being stored, the issue is likely a design issue having to do with the iCloud sync feature used to provide consistent Safari history data across all of a user’s iOS and macOS devices. 
It is normal for synchronization services to maintain deleted “tombstone” records to keep track of deleted data until those deletions have synchronized with all of the connected devices, however there doesn’t appear to be any obvious reason why data would need to be retained beyond this time frame.
While Apple declined to comment on Elcomsoft’s findings, a source with knowledge of the matter told Forbes that Apple has been making it harder in recent Safari and iOS versions to track browsing history by turning URLs into hashes, although this step obviously was not enough to prevent Elcomsoft’s tool from accessing this information in a clear form. 
We have informed media about this issue in advance, and they reached Apple for comments. As far as we know, Apple has not responded, but started purging older history records.
For what we know, they could be just moving them to other servers, making deleted records inaccessible from the outside; but we never know for sure. Either way, as of right now, for most iCloud accounts we can see history records for the last two weeks only (deleted records for those two weeks are still there though). blog.elcomsoft
iCloud: Change iCloud feature settings
You can change which iCloud features you are using on any of your devices by turning features on or off. You can also turn off iCloud completely.
  • Like 1

Share this post

Link to post
Share on other sites
Sign in to follow this