Your Favorite Flashlight App Can Track You!

“Five hundred million people are infected, and they don’t know it, but it’s not them; it’s their smartphones.”
— Gary Miliefsky, Cyber Security Expert, Founder, SnoopWall.

A TechTips subscriber forwarded me an email last week with a YouTube link to a TV news program about infected Android flashlight apps.

October is Cyber Awareness Month, and this article is just a small piece of the puzzle in keeping your (and your organization’s) information safe.

The issue that Miliefsky highlights is that some smartphone apps track information about you and take information on your phone and send it to other countries. According to Miliefsky, the top 10 apps today that you can download from the Google Play store are all tracking apps, and there have been approximately half a billion downloads of these apps.

Here is what happens. When you install a particular flashlight app on your Android smartphone and hit the ON button, a dialog box appears asking you for access to your personal information, such as your name, address, all of your family photos, contacts and, most important, your credit card/account numbers could all be compromised. These are details you would never want to be sent anywhere.

Someone is stealing your information and sending this data to other nations (China, India and Russia).

The creator of one of the most popular apps for Android mobile devices has agreed to settle Federal Trade Commission (FTC) charges that its free app, which allows a device to be used as a flashlight, deceived consumers about how their geolocation information would be shared with advertising networks and other third parties: Android Flashlight App Developer Settles FTC Charges It Deceived Consumers.

When installing any apps, most people do not read the Terms & Conditions included in the app description on the Google Play Store. They instantly hit the ACCEPT button, allowing their personal data to be transferred. Uninstalling the app will not always solve the problem. The only sure solution is to uninstall the app and restore the factory settings of the device. This is because, even after uninstalling, there are Trojans and malware lurking in the background, waiting for you to access things like your contact list or banking information. Restoring the factory settings will ensure they are removed.

Suggestions to Protect Your Phone Information

• Disable your GPS at all times, except for an emergency or if you need to use your smartphone for navigation purposes.
• Disable your NFC (Near Field Communications) for Android devices, or iBeacon on Apple devices, permanently.
• Disable Bluetooth at all times, except when you are driving and want to have hands-free calls.
• Verify the app’s behavior and privacy risk prior to installation. Always try to find an alternative before installing any unsafe/threatening apps.
• Use masking tape over your webcam and microphone when you’re not using the device or take out the battery from your smartphone when the device is not in use.

Miliefsky has suggested only installing flashlight apps that are 100 KB or under. Any such app whose size ranges between 1.2-5 MB is a questionable application. He also mentions that before performing a factory reset, one should ensure that all relevant/personal data such as contacts, family pictures, etc. (mainly core information) are backed up.

This threat is most prevalent in the Google/Android OS. Windows and Apple iOS flashlights might behave in a similar manner. However, the threat is not as great as that of the Android OS. This is because their spying capabilities are limited due to the hardened OS features of Windows 8.1 RT and Apple iOS 7 & 8.

What apps have you found that threaten your phone’s security? Let me know your experience.