No Privacy Among Spies: Assessing the Functionality and Insecurity of Consumer Android Spyware Apps

Abstract

Consumer mobile spyware apps covertly monitor a user's activities (i.e., text messages, phone calls, e-mail, location, etc.) and transmit that information over the Internet to support remote surveillance. Unlike conceptually similar apps used for state espionage, so-called "stalkerware" apps are mass-marketed to consumers on a retail basis and expose a far broader range of victims to invasive monitoring. Today the market for such apps is large enough to support dozens of competitors, with individual vendors reportedly monitoring hundreds of thousands of phones. However, while the research community is well aware of the existence of such apps, our understanding of the mechanisms they use to operate remains ad hoc. In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence. Additionally, we document the measures taken by each app to protect the privacy of the sensitive data they collect, identifying a range of failings on the part of spyware vendors (including privacy-sensitive data sent in the clear or stored in the cloud with little or no protection).

Assessing the Security and Privacy of Baby Monitor Apps

“…Baby monitoring apps are designed to observe, and thus, apply methods similar to video surveillance solutions, such as recording and processing pictures, videos, and audio material. Although privacy consent for such actions is abdicated to children's guardians, there is the potential to use the data collected by such apps illegally [16]. In addition to the challenges of mobile app security and privacy, video surveillance systems have their own difficulties.…”