Vietnamese texting and calling app Zalo is thought to be gathering data from iPhone clipboards without user consent.
Several iPhone users of the iOS 14 beta operating system have received notifications stating Zalo had copied and pasted clipboard info between applications.
Tran Tuyen, a Hanoi-based IT expert, said the fact that an app could collect data from a clipboard means Apple had allowed such a process and that it did not violate any policy. However, developers need to inform users how such data is used to avoid any misunderstanding.
Zalo’s terms and conditions request the app to be allowed access to contact, location, Internet access, personal user info (email, phone number, personal identification), and general info (Zalo version, phone properties), promising to keep messages private and not to track users.
Vo Duc Thang, director of cybersecurity education firm Athena, said the fact that Zalo could automatically collect clipboard data makes it difficult for users to know how such data is used however.
“Zalo automatically collecting clipboard data would create several security risks, if the copied data included usernames, passwords or bank account OTPs,” Thang said.
The app provider is yet to respond concerning the matter.
Zalo is not the only application found to be automatically collecting clipboard data. Popular apps like video-sharing social network app TikTok or weather forecast app AccuWeather have also been found to do the same. TikTok however has removed that function in a patch provided on the App Store, saying data collecting was to identify and prevent spamming.
Owned by Vietnamese tech firm VNG Corporation, Zalo began operating in 2012 as an Internet application for calling and texting, though tied to personal phone numbers. Zalo’s functions later expanded to include personal profiles and the uploading of images and videos.
It has grown into a popular messenger app, garnering over 100 million users globally after seven years.
Reported by Luu Quy, @Vnexpress