Keylogger attacks — where your input is recorded in order to discover your passwords and other data — have been extant in the traditional computing world for ages but they've recently begun creeping into mobile as well. Typically this involves getting a malicious app onto your device that then records what you're tapping on or clicking and where. Thanks to Apple's tight iPhone and iPad security, these attacks have previously only been possible on jailbroken devices. Not so anymore, according to Min Zheng, Hui Xue, and Tao Wei. FireEye:
We have created a proof-of-concept "monitoring" app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server, as shown in Fig.1. Potential attackers can use such information to reconstruct every character the victim inputs.
They claim the exploit they're using affects devices on iOS 7, including 7.0.4, 7.0.5, and 7.0.6, as well as all versions of iOS 6.
There's not a lot of information available yet about how exactly this works, but it seems like an attacker would have to make a malicious app, get it passed App Store review and into the App Store, and then get you to go to the App Store and install it onto your device. For example, someone emailing you a link to a knock-off app — "Hey John, check out Flappy Bards, it's free and awesome!"
The researchers suggest uber-paranoid users turn off background refresh and kill all background apps to avoid any possibility of exploit. That's so onerous I doubt many will do it. What's probably better is to follow the same old "don't click on links from people or sources you don't trust" (even if they take you to the App Store) advice, and when browsing the App Store on your own, stick to apps from known developers until Apple patches the exploit.
Most importantly, the exploit seems complex right now and no one has presented any evidence of it existing in the wild. Unless and until that changes, I'd recommend the usual caution but no crazy level of concern. Agree or disagree?