mld53a

The system clipboard often contains some of the most sensitive data users routinely and temporarily store on their devices. Indeed, users store information, such as photos, text messages, e-mails, cryptographic keys, or even medical records, in their device clipboards to name a few examples. And LinkedIn was surreptitiously reading it—again and again and again—without any user-triggered paste commands, and without even notifying the user. LinkedIn’s conduct, which continued for potentially years before Apple’s iOS 14 beta laid bare its existence, was particularly egregious for users with more than one Apple device.

A feature on Apple iOS and MacOS devices called the Universal Clipboard allows nearby devices to share clipboard information. Thus, a photo “copied” on a Mac computer is instantly transferred to a nearby iPhone’s clipboard—but it only remains available to a user on that device for 120 seconds for security reasons.

Yet the LinkedIn App doesn’t just cut the user out of the clipboard equation—it circumvents the 120 second timeout on Apple’s Universal Clipboard. Specifically, the LinkedIn App repeatedly reads the Universal Clipboard with every user keystroke, and these 'reads' are interpreted by Apple’s Universal Clipboard as a 'paste' command, which takes the temporary information in the Universal Clipboard and removes the 120 second timeout. Simply put, LinkedIn has not only been spying on its users, it has been spying on their nearby computers and other devices, and it has been circumventing Apple’s Universal Clipboard timeout policy in doing so.