Anyone who uses Apple’s iPhone mirroring feature on their Mac, which was released in September, should be aware that it leaves data on the machine. If it is a business computer, these may appear in the corporate system if the IT department uses the system to record software inventory. before this Warned security company servantsIn practice, potentially sensitive private data on the iPhone would then be accessible in a corporate context.
Advertisement
app stubs on mac
iPhone Mirroring is new in macOS 15 and iOS 18 and allows you to remotely control an iPhone from a Mac. This function is available in all countries outside the EU (depending on the location of the App Store ID) and can be practical if the smartphone is at the other end of the room. You can also use it to display notifications directly on the Mac that would otherwise only be visible on the iPhone. Drag-and-drop between Mac and iPhone will also be possible in the future.
In operation, iPhone mirroring relies on so-called app stubs. These end up in a cache folder and collect a lot of metadata from the connected iPhone, including installed apps and file details including their installation date, version, and icon. These can be found using tools like mdfind. Problem: For software inventory systems, app studs look like real apps. If the IT department records inventory, personal apps from the user’s iPhone also end up in the inventory. Sevco cites a company in a country where VPNs are banned as a possible example. The IT department can detect from a Mac that an employee is using it on an iPhone. The same applies to health or dating apps.

Apple has been informed
Sevco has already reported the problem to Apple and said it should be fixed soon. It is generally not advisable to use your personal iPhone on a company computer, especially since you will have entered your own Apple ID into the system to connect using iPhone mirroring.
This behavior can also have consequences for the companies themselves. “For companies, this flaw presents a new data risk by potentially collecting private employee data. If not addressed, this flaw could lead to violations of critical data protection laws, potential litigation, and regulatory action. “
(B.Sc.)
