I Tracked Myself With $170 Smartphone Spyware that Anyone Can Buy
motherboard.vice.com
motherboard.vice.com
1) Get physical access to the phone and be able to unlock it.
2) Manually disable the Android setting so that non verified apps can be installed (the setting is enabled by default on almost every Google Android phone to protect users). By doing so a clear message warns the user that the phone will become vulnerable to attackers.
3) Install an obscure apk on the phone (side load or via link) outside of the Play Store.
I would call this just installing an app that is designed to track you. Such an app is trivial to code.
When you decide to set your OS free to make it possible to install anything then obviously you can install anything on it, including a spyware.
It makes no sense to compare this to iOS because iOS doesn't allow 2) (walled garden). Android leaves it up to you and thus provides more "freedom" to users. Freedom comes with additional risks. The equivalent is jailbreaking on iOS (unofficial).
I like to compare this with someone being locked in a room. This person is obviously less likely to die from a car accident than a free one. But does that mean you want to live locked in a room ?
But my question is about desktop app, is it true that any app could contain malware ? Even popular apps like Transmission have been infected, how about those that are not popular and the antivirus doesnt know about ?
Xcode was hacked not so long ago. The malware could remain invisible even to the creators of the app. Although it's less likely to remain unnoticed with open source projects due to the visible nature of it.
On desktop, Mac OS and Windows now provides official stores where apps are verified and signed.
On Android I remember Google added an app scanner in order to detect infected apps even when the security setting is disabled. On windows there is defender.
At the end of the day it's all about trust. Be very careful regarding where you download the software from.
Secondly, I thought how easily someone (boss, co-worker, spouse, etc) could use this as a surveillance device. Just leaving the phone lying around and remotely turn on the mic and camera. (I'm aware of other apps that have this functionality).
Thirdly, I thought it could be useful if my phone was ever lost or stolen. But at the same time, I would be enabling a backdoor into my phone. Trusting a company that develops spyware is a huge leap too.
Fourthly... and actually this was my first thought: Many have already given the Operating Systems they use daily carte blanche to do the very things these spyware apps are able to do. Toss in data-mining and even worse... data-sharing and these spyware apps look like amateur attempts at spyware.
There are a number of use cases but most seem to be pretty bad. Even their followup article[1] is scary (hard to remove even after a factory reset, best to use another phone).
[1] https://motherboard.vice.com/en_us/article/how-to-protect-yo...
Is it there any software or means to reset/clean a phone or computer? Is it possible to backup all your data and accounts into external storage, wipe the device clean and, after customs, reset it again?
Not sure how much of the above is possible on an unrooted phone.
I will root my phone next month and start playing with them.
But there is no easy service you can buy to start monitoring cameras and microphones.
In general it's more secure than Android.
On iOS, you can't disable security at all (yay freedom), but you can just jailbreak the phone and install whatever you want. If the attacker has physical access to the phone, security on both platforms is comparable, i.e. zero.
On top of that there is no such thing as an unteathered jailbreak for iOS 10. The best you can hope for is a semi teathered jailbreak which requires you to manually run an app every time your phone restarts.
Also doing all those steps you mention are meaningless is many cases because an attacker close to you (think bitter divorce or corrupt business colleague) can just grab your phone for a minute and your goose is cooked.
I'm considering switching from Android to iOS since I've heard good things about the security and privacy.
It's generally game over for any device if the attacker has physical access.
Yeah, he clearly says he had to side load that thing, and yet near the top of the story he says this:
'With a single SMS message, this spy had remotely activated the microphone in my smartphone, turning it into a portable and surreptitious eavesdropping device.'
That kind of implies that is how this thing was installed, but that's not really how it worked.
The attacker needed access to the unlocked phone.
That was your first thought? I guess it's time get a divorce lawyer. Regardless, it's really that easy? Why don't you have your phone locked?
Right now, this was my first thought.