advanced help
phrase:
attribute:
attribute:
attribute:
order:
per page:
clip:
action:
Results of 1 - 1 of about 725 for Android 12 (2.115 sec.)
android (2801), 12 (27799)
/proprietary/malware-mobiles.html-diff
#score: 5143
@digest: f26c78beeb6f6b8321adaa602806dc74
@id: 113585
@lang: en
@mdate: 2019-06-11T12:01:40Z
@size: 90112
@type: text/html
content-type: text/html; charset=utf-8
#keywords: phones (18580), mobile (15565), samsung (15285), apps (14906), android (13677), arstechnica (12934), facebook (12133), theguardian (10925), snooping (9930), consent (9124), spyware (9025), li (8701), tyrants (8585), phone (8451), href (8234), surveillance (6822), https (6726), malware (6687), google (6654), snoop (6544), personal (6529), app (6029), privacy (5351), listening (5236), tracking (5088), proprietary (5047), universal (4667), devices (4573), door (3871), malicious (3513), security (3476), users (3212)
<!--#include virtual="/server/header.html" --> <!-- Parent-Version: 1.84 1.86 --> <!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Please do not edit <ul class="blurbs">! Instead, edit /proprietary/workshop/mal.rec, then regenerate pages. See explanations in /proprietary/workshop/README.md. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --> <title>Malware in Mobile Devices - GNU Project - Free Software Foundation</title> <style type="text/css" media="print,screen"><!-- li dl { margin-top: .3em; } li dl dt { margin: .3em 0 0 0; font-weight: normal; font-style: italic; } li dl dd { margin: 0 3%; } --></style> <!--#include virtual="/proprietary/po/malware-mobiles.translist" --> <!--#include virtual="/server/banner.html" --> <h2>Malware in Mobile Devices</h2> <p><a href="/proprietary/proprietary.html">Other examples of proprietary malware</a></p> <div class="highlight-para"> class="comment"> <p> <em>Malware</em> means software designed to function in ways that mistreat or harm the user. (This does not include accidental errors.) </p> <p> Malware and nonfree software are two different issues. The difference between <a href="/philosophy/free-sw.html">free software</a> and nonfree software is in <a href="/philosophy/free-software-even-more-important.html"> whether the users have control of the program or vice versa</a>. It's not directly a question of what the program <em>does</em> when it runs. However, in practice nonfree software is often malware, because the developer's awareness that the users would be powerless to fix any malicious functionalities tempts the developer to impose some. </p> </div> <p>Here are examples of malware in <p>Nearly all mobile devices. See also the <a href="/proprietary/malware-apple.html">the Apple malware page</a> for malicious functionalities specific phones do two grievous wrongs to the Apple iThings.</p> <div class="summary" style="margin-top: 1em"> <h3>Type of malware</h3> <ul> <li><a href="#back-doors">Back doors</a></li> <!--<li><a href="#censorship">Censorship</a></li>--> <li><a href="#insecurity">Insecurity</a></li> <!--<li><a href="#sabotage">Sabotage</a></li>--> <!--<li><a href="#interference">Interference</a></li>--> <li><a href="#surveillance">Surveillance</a></li> <li><a href="#drm">Digital restrictions management</a> or “DRM” means functionalities designed their users: tracking their movements, and listening to restrict what users can do with the data in their computers.</li> <li><a href="#jails">Jails</a>—systems that impose censorship on application programs.</li> <li><a href="#tyrants">Tyrants</a>—systems conversations. This is why we call them “Stalin's dream”.</p> <p>The malware we list here is present in every phone, or in software that reject any operating system is not “authorized” made by the manufacturer.</li> </ul> </div> <h3 id="back-doors">Mobile Back Doors</h3> <ul> <li> <p>The universal back door Apple or Google (including its subsidiaries). Malicious functionalities in portable phones mobile software released by Apple or Google are listed in dedicated pages, <a href="https://www.schneier.com/blog/archives/2006/12/remotely_eavesd_1.html"> is employed href="/proprietary/malware-apple.html">Apple's Operating Systems are Malware</a> and <a href="/proprietary/malware-google.html">Google's Software Is Malware</a> respectively.</p> <div class="important"> <p>If you know of an example that ought to listen through their microphones</a>.</p> <p>Most mobile phones have be in this universal back door, which has been used page but isn't here, please write to <a href="http://www.slate.com/blogs/future_tense/2013/07/22/nsa_can_reportedly_track_cellphones_even_when_they_re_turned_off.html"> turn them malicious</a>.</p> <p>More about <a href="http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone">the nature href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a> to inform us. Please include the URL of this problem</a>.</p> </li> <li><p><a href="https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor"> Samsung Galaxy devices running proprietary Android versions come with a back door</a> that provides remote access trustworthy reference or two to serve as specific substantiation.</p> </div> </div> <div class="column-limit" id="phone-communications"></div> <ul class="blurbs"> <li id="M201502100"> <p>The phone network <a href="https://ssd.eff.org/en/module/problem-mobile-phones"> tracks the data stored on movements of each phone</a>.</p> <p>This is inherent in the device.</p> </li> <li><p><a href="/proprietary/proprietary-back-doors.html#samsung"> Samsung's back door</a> provides access to any file on design of the system.</p> </li> <li> <p>In Android, <a href="http://www.computerworld.com/article/2506557/security0/google-throws--kill-switch--on-android-phones.html"> Google has a back door to remotely delete apps</a> (it phone network: as long as the phone is in a program called GTalkService). </p> <p>Google can also <a href="https://web.archive.org/web/20150520235257/https://jon.oberheide.org/blog/2010/06/25/remote-kill-and-install-on-google-android/" title="at communication with the Wayback Machine (archived May 20, 2015)">forcibly and remotely install apps</a> through GTalkService (which seems, since that article, to have been merged into Google Play). This adds up network, there is no way to stop the network from recording its location. Many countries (including the US and the EU) require the network to store all these location data for months or years.</p> </li> <li id="M201311120.1"> <p id="universal-back-door-phone-modem"> Almost every phone's communication processor has a universal back door. </p> <p> Although Google's <em>exercise</em> of this power has not been malicious so far, the point is that nobody should have such power, door which could also be is <a href="https://www.schneier.com/blog/archives/2006/12/remotely_eavesd_1.html"> often used maliciously. You might well decide to let make a security service remotely <em>deactivate</em> programs that it considers malicious. But there is no excuse for allowing phone transmit all conversations it to <em>delete</em> hears</a>.</p> <p>The back door <a class="not-a-duplicate" href="http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone"> may take the programs, and you should form of bugs that have the right gone 20 years unfixed</a>. The choice to decide who (if anyone) leave the security holes in place is morally equivalent to trust writing a back door.</p> <p>The back door is in this way. </p> </li> </ul> <h3 id="insecurity">Mobile Insecurity</h3> <p>These bugs are/were not intentional, so unlike the rest of “modem processor”, whose job is to communicate with the file they do not count as malware. We mention them radio network. In most phones, the modem processor controls the microphone. In most phones it has the power to refute rewrite the supposition that prestigious proprietary software doesn't have grave bugs.</p> <ul> <li> <p>Siri, Alexa, and all for the other voice-control systems can be <a href="https://www.fastcodesign.com/90139019/a-simple-design-flaw-makes-it-astoundingly-easy-to-hack-siri-and-alexa">hijacked by programs main processor too.</p> <p>A few phone models are specially designed so that play commands in ultrasound the modem processor does not control the microphone, and so that humans it can't hear</a>. </p> </li> <li> <p>Many Android devices <a href="https://arstechnica.com/security/2017/04/wide-range-of-android-phones-vulnerable-to-device-hijacks-over-wi-fi/"> can be hijacked through their Wi-Fi chips</a> because of a bug change the software in Broadcom's non-free firmware.</p> </li> <li> <p>Samsung phones <a href="https://www.bleepingcomputer.com/news/security/sms-exploitable-bug-in-samsung-galaxy-phones-can-be-used-for-ransomware-attacks/">have the main processor. They still have the back door, but at least it is unable to turn the phone unto a security hole that allows an SMS message listening device.</p> <p>The universal back door is apparently also used to install ransomware</a>.</p> </li> <li> <p>Many proprietary payment apps make phones <a href="http://www.bloomberg.com/news/articles/2016-03-10/many-mobile-payments-startups-aren-t-properly-securing-user-data"> href="http://www.slate.com/blogs/future_tense/2013/07/22/nsa_can_reportedly_track_cellphones_even_when_they_re_turned_off.html"> transmit personal data in an insecure way</a>. However, even when they are turned off</a>. This means their movements are tracked, and may also make the worse aspect of these apps is that <a href="/philosophy/surveillance-vs-democracy.html">payment is not anonymous</a>. </p> listening feature work.</p> </li> <li><p><a href="http://www.spiegel.de/international/world/privacy-scandal-nsa-can-spy-on-smart-phone-data-a-920971.html"> The NSA </ul> <div class="summary" style="margin-top: 1em"> <h3>Type of malware</h3> <ul> <li><a href="#back-doors">Back doors</a></li> <!--<li><a href="#censorship">Censorship</a></li>--> <li><a href="#drm">Digital restrictions management</a> or “DRM”—functionalities designed to restrict what users can tap do with the data in smart phones, including iPhones, Android, and BlackBerry</a>. While there is not much detail here, it seems their computers.</li> <li><a href="#insecurity">Insecurity</a></li> <li><a href="#interference">Interference</a></li> <li><a href="#manipulation">Manipulation</a></li> <li><a href="#sabotage">Sabotage</a></li> <li><a href="#surveillance">Surveillance</a></li> <li><a href="#jails">Jails</a>—systems that this does impose censorship on application programs.</li> <li><a href="#tyrants">Tyrants</a>—systems that reject any operating system not operate via “authorized” by the manufacturer.</li> </ul> </div> <h3 id="back-doors">Mobile Back Doors</h3> <ul class="blurbs"> <li id="M209900001"> <p>See above for the <a href="#universal-back-door-phone-modem">general universal back door that we know nearly door</a> in essentially all portable mobile phones, which permits converting them into full-time listening devices.</p> </li> <li id="M201609130"> <p>Xiaomi phones have. It may involve exploiting various bugs. There are come with <a href="http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone"> lots of bugs href="https://web.archive.org/web/20190424082647/http://blog.thijsbroenink.com/2016/09/xiaomis-analytics-app-reverse-engineered/"> a universal back door in the phones' radio software</a>.</p> </li> </ul> <h3 id="surveillance">Mobile Surveillance</h3> <ul> <li><p>The Sarahah app application processor, for Xiaomi's use</a>.</p> <p>This is separate from <a href="https://theintercept.com/2017/08/27/hit-app-sarahah-quietly-uploads-your-address-book/"> uploads all phone numbers and email addresses</a> href="#universal-back-door-phone-modem">the universal back door in user's address book to developer's server. Note the modem processor that this article misuses the words “<a href="/philosophy/free-sw.html">free software</a>” referring to zero price.</p> local phone company can use</a>.</p> </li> <li><p>Some portable phones <li id="M201511090"> <p>Baidu's proprietary Android library, Moplus, has a back door that <a href="http://www.prnewswire.com/news-releases/kryptowire-discovered-mobile-phone-firmware-that-transmitted-personally-identifiable-information-pii-without-user-consent-or-disclosure-300362844.html">are sold with spyware sending lots href="https://www.eff.org/deeplinks/2015/11/millions-android-devices-vulnerable-remote-hijacking-baidu-wrote-code-google-made"> can “upload files” as well as forcibly install apps</a>.</p> <p>It is used by 14,000 Android applications.</p> </li> <li id="M201412180"> <p><a href="http://www.theguardian.com/technology/2014/dec/18/chinese-android-phones-coolpad-hacker-backdoor"> A Chinese version of data to China</a>.</p></li> <li> <p>Facebook's app listens Android has a universal back door</a>. Nearly all the time, models of mobile phones have a <a href="http://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-using-people-s-phones-to-listen-in-on-what-they-re-saying-claims-professor-a7057526.html">to snoop on what people are listening href="#universal-back-door-phone-modem"> universal back door in the modem chip</a>. So why did Coolpad bother to introduce another? Because this one is controlled by Coolpad.</p> </li> <li id="M201403120.1"> <p id="samsung"><a href="https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor"> Samsung Galaxy devices running proprietary Android versions come with a back door</a> that provides remote access to the files stored on the device.</p> </li> </ul> <h3 id="drm">Mobile DRM</h3> <ul class="blurbs"> <li id="M201501030"> <p id="netflix-app-geolocation-drm">The Netflix Android app <a href="http://torrentfreak.com/netflix-cracks-down-on-vpn-and-proxy-pirates-150103/"> forces the use of Google DNS</a>. This is one of the methods that Netflix uses to enforce the geolocation restrictions dictated by the movie studios.</p> </li> </ul> <h3 id="insecurity">Mobile Insecurity</h3> <p>These bugs are/were not intentional, so unlike the rest of the file they do not count as malware. We mention them to refute the supposition that prestigious proprietary software doesn't have grave bugs.</p> <ul class="blurbs"> <li id="M201807100"> <p>Siri, Alexa, and all the other voice-control systems can be <a href="https://www.fastcodesign.com/90139019/a-simple-design-flaw-makes-it-astoundingly-easy-to-hack-siri-and-alexa"> hijacked by programs that play commands in ultrasound that humans can't hear</a>.</p> </li> <li id="M201807020"> <p>Some Samsung phones randomly <a href="https://www.theverge.com/circuitbreaker/2018/7/2/17528076/samsung-phones-text-rcs-update-messages">send photos to people in the owner's contact list</a>.</p> </li> <li id="M201704050"> <p>Many Android devices <a href="https://arstechnica.com/security/2017/04/wide-range-of-android-phones-vulnerable-to-device-hijacks-over-wi-fi/"> can be hijacked through their Wi-Fi chips</a> because of a bug in Broadcom's non-free firmware.</p> </li> <li id="M201702170"> <p>The mobile apps for communicating <a href="https://www.bleepingcomputer.com/news/security/millions-of-smart-cars-vulnerable-due-to-insecure-android-apps/">with a smart but foolish car have very bad security</a>.</p> <p>This is in addition to the fact that the car contains a cellular modem that tells big brother all the time where it is. If you own such a car, it would be wise to disconnect the modem so as to turn off the tracking.</p> </li> <li id="M201701270"> <p>Samsung phones <a href="https://www.bleepingcomputer.com/news/security/sms-exploitable-bug-in-samsung-galaxy-phones-can-be-used-for-ransomware-attacks/">have a security hole that allows an SMS message to install ransomware</a>.</p> </li> <li id="M201701130"> <p>WhatsApp has a feature that <a href="https://techcrunch.com/2017/01/13/encrypted-messaging-platform-whatsapp-denies-backdoor-claim/"> has been described as a “back door”</a> because it would enable governments to nullify its encryption.</p> <p>The developers say that it wasn't intended as a back door, and that may well be true. But that leaves the crucial question of whether it functions as one. Because the program is nonfree, we cannot check by studying it.</p> </li> <li id="M201607290"> <p><a href="https://techcrunch.com/2016/07/29/research-shows-deleted-whatsapp-messages-arent-actually-deleted/">“Deleted” WhatsApp messages are not entirely deleted</a>. They can be recovered in various ways.</p> </li> <li id="M201607280"> <p>A half-blind security critique of a tracking app: it found that <a href="http://www.consumerreports.org/mobile-security-software/glow-pregnancy-app-exposed-women-to-privacy-threats/"> blatant flaws allowed anyone to snoop on a user's personal data</a>. The critique fails entirely to express concern that the app sends the personal data to a server, where the <em>developer</em> gets it all. This “service” is for suckers!</p> <p>The server surely has a “privacy policy,” and surely it is worthless since nearly all of them are.</p> </li> <li id="M201607190"> <p>A bug in a proprietary ASN.1 library, used in cell phone towers as well as cell phones and routers, <a href="http://arstechnica.com/security/2016/07/software-flaw-puts-mobile-phones-and-networks-at-risk-of-complete-takeover">allows taking control of those systems</a>.</p> </li> <li id="M201603100"> <p>Many proprietary payment apps <a href="http://www.bloomberg.com/news/articles/2016-03-10/many-mobile-payments-startups-aren-t-properly-securing-user-data">transmit personal data in an insecure way</a>. However, the worse aspect of these apps is that <a href="/philosophy/surveillance-vs-democracy.html">payment is not anonymous</a>.</p> </li> <li id="M201505294"> <p><a href="http://phys.org/news/2015-05-app-vulnerability-threatens-millions-users.html"> Many smartphone apps use insecure authentication methods when storing your personal data on remote servers</a>. This leaves personal information like email addresses, passwords, and health information vulnerable. Because many of these apps are proprietary it makes it hard to impossible to know which apps are at risk.</p> </li> <li id="M201405190"> <p>An app to prevent “identity theft” (access to personal data) by storing users' data on a special server <a href="http://arstechnica.com/tech-policy/2014/05/id-theft-protector-lifelock-deletes-user-data-over-concerns-that-app-isnt-safe/">was deactivated by its developer</a> which had discovered a security flaw.</p> <p>That developer seems to be conscientious about protecting personal data from third parties in general, but it can't protect that data from the state. Quite the contrary: confiding your data to someone else's server, if not first encrypted by you with free software, undermines your rights.</p> </li> <li id="M201402210"> <p>The <a href="http://arstechnica.com/security/2014/02/crypto-weaknesses-in-whatsapp-the-kind-of-stuff-the-nsa-would-love/">insecurity of WhatsApp</a> makes eavesdropping a snap.</p> </li> <li id="M201311120"> <p><a href="https://web.archive.org/web/20180816030205/http://www.spiegel.de/international/world/privacy-scandal-nsa-can-spy-on-smart-phone-data-a-920971.html"> The NSA can tap data in smart phones, including iPhones, Android, and BlackBerry</a>. While there is not much detail here, it seems that this does not operate via the universal back door that we know nearly all portable phones have. It may involve exploiting various bugs. There are <a href="http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone"> lots of bugs in the phones' radio software</a>.</p> </li> </ul> <h3 id="interference">Mobile Interference</h3> <p>This section gives examples of mobile apps harassing or annoying the user, or causing trouble for the user. These actions are like sabotage but the word “sabotage” is too strong for them.</p> <ul class="blurbs"> <li id="M201901110"> <p>Samsung phones come preloaded with <a href="https://www.bloomberg.com/news/articles/2019-01-08/samsung-phone-users-get-a-shock-they-can-t-delete-facebook"> a version of the Facebook app that can't be deleted</a>. <a href="https://www.infopackets.com/news/10484/truth-behind-undeletable-facebook-app"> Facebook claims this is a stub</a> which doesn't do anything, but we have to take their word for it, and there is the permanent risk that the app will be activated by an automatic update.</p> <p>Preloading crapware along with a nonfree operating system is common practice, but by making the crapware undeletable, Facebook and Samsung (<a class="not-a-duplicate" href="https://www.bloomberg.com/news/articles/2019-01-08/samsung-phone-users-get-a-shock-they-can-t-delete-facebook">among others</a>) are going one step further in their hijacking of users' devices.</p> </li> </ul> <h3 id="manipulation">Mobile Manipulation</h3> <ul class="blurbs"> <li id="M201905300"> <p>The Femm “fertility” app is secretly a <a href="https://www.theguardian.com/world/2019/may/30/revealed-womens-fertility-app-is-funded-by-anti-abortion-campaigners"> tool for propaganda</a> by natalist Christians. It spreads distrust for contraception.</p> <p>It snoops on users, too, as you must expect from nonfree programs.</p> </li> </ul> <h3 id="sabotage">Mobile Sabotage</h3> <ul class="blurbs"> <li id="M201902041"> <p>Twenty nine “beauty camera” apps that used to be on Google Play had one or more malicious functionalities, such as stealing users' photos instead of “beautifying” them, <a href="https://www.teleanalysis.com/news/national/these-29-beauty-camera-apps-steal-private-photo-29923">pushing unwanted and often malicious ads on users, and redirecting them to phishing sites</a> that stole their credentials. Furthermore, the user interface of most of them was designed to make uninstallation difficult.</p> <p>Users should of course uninstall these dangerous apps if they haven't yet, but they should also stay away from nonfree apps in general. <em>All</em> nonfree apps carry a potential risk because there is no easy way of knowing what they really do.</p> </li> <li id="M201810240"> <p>Apple and Samsung deliberately <a href="https://www.theguardian.com/technology/2018/oct/24/apple-samsung-fined-for-slowing-down-phones">degrade the performance of older phones to force users to buy their newer phones</a>.</p> </li> </ul> <h3 id="surveillance">Mobile Surveillance</h3> <ul class="blurbs"> <li id="M201905280"> <p>In spite of Apple's supposed commitment to privacy, iPhone apps contain trackers that are busy at night <a href="https://freediggz.com/2019/05/28/perspective-its-the-middle-of-the-night-do-you-know-who-your-iphone-is-talking-to/"> sending users' personal information to third parties</a>.</p> <p>The article mentions specific examples: Microsoft OneDrive, Intuit's Mint, Nike, Spotify, The Washington Post, The Weather Channel (owned by IBM), the crime-alert service Citizen, Yelp and DoorDash. But it is likely that most nonfree apps contain trackers. Some of these send personally identifying data such as phone fingerprint, exact location, email address, phone number or even delivery address (in the case of DoorDash). Once this information is collected by the company, there is no telling what it will be used for.</p> </li> <li id="M201905060"> <p>BlizzCon 2019 imposed a <a href="https://arstechnica.com/gaming/2019/05/blizzcon-2019-tickets-revolve-around-invasive-poorly-reviewed-smartphone-app/"> requirement to run a proprietary phone app</a> to be allowed into the event.</p> <p>This app is a spyware that can snoop on a lot of sensitive data, including user's location and contact list, and has <a href="https://old.reddit.com/r/wow/comments/bkd5ew/you_need_to_have_a_phone_to_attend_blizzcon_this/emg38xv/"> near-complete control</a> over the phone.</p> </li> <li id="M201904131"> <p>Data collected by menstrual and pregnancy monitoring apps is often <a href="https://www.theguardian.com/world/2019/apr/13/theres-a-dark-side-to-womens-health-apps-menstrual-surveillance"> available to employers and insurance companies</a>. Even though the data is “anonymized and aggregated,” it can easily be traced back to the woman who uses the app.</p> <p>This has harmful implications for women's rights to equal employment and freedom to make their own pregnancy choices. Don't use these apps, even if someone offers you a reward to do so. A free-software app that does more or less the same thing without spying on you is available from <a href="https://search.f-droid.org/?q=menstr">F-Droid</a>, and <a href="https://www.bloomberg.com/news/audio/2019-04-10/building-a-better-period-tracking-app-podcast"> a new one is being developed</a>.</p> </li> <li id="M201903251"> <p>Many Android phones come with a huge number of <a href="https://elpais.com/elpais/2019/03/22/inenglish/1553244778_819882.html"> preinstalled nonfree apps that have access to sensitive data without users' knowledge</a>. These hidden apps may either call home with the data, or pass it on to user-installed apps that have access to the network but no direct access to the data. This results in massive surveillance on which the user has absolutely no control.</p> </li> <li id="M201903201"> <p>A study of 24 “health” apps found that 19 of them <a href="https://motherboard.vice.com/en_us/article/pan9e8/health-apps-can-share-your-data-everywhere-new-study-shows"> send sensitive personal data to third parties</a>, which can use it for invasive advertising or discriminating against people in poor medical condition.</p> <p>Whenever user “consent” is sought, it is buried in lengthy terms of service that are difficult to understand. In any case, “consent” is not sufficient to legitimize snooping.</p> </li> <li id="M201902230"> <p>Facebook offered a convenient proprietary library for building mobile apps, which also <a href="https://boingboing.net/2019/02/23/surveillance-zucksterism.html"> sent personal data to Facebook</a>. Lots of companies built apps that way and released them, apparently not realizing that all the personal data they collected would go to Facebook as well.</p> <p>It shows that no one can trust a nonfree program, not even the developers of other nonfree programs.</p> </li> <li id="M201902140"> <p>The AppCensus database gives information on <a href="https://www.appcensus.mobi"> how Android apps use and misuse users' personal data</a>. As of March 2019, nearly 78,000 have been analyzed, of which 24,000 (31%) transmit the <a href="/proprietary/proprietary-surveillance.html#M201812290"> Advertising ID</a> to other companies, and <a href="https://blog.appcensus.mobi/2019/02/14/ad-ids-behaving-badly/"> 18,000 (23% of the total) link this ID to hardware identifiers</a>, so that users cannot escape tracking by resetting it.</p> <p>Collecting hardware identifiers is in apparent violation of Google's policies. But it seems that Google wasn't aware of it, and, once informed, was in no hurry to take action. This proves that the policies of a development platform are ineffective at preventing nonfree software developers from including malware in their programs.</p> </li> <li id="M201902060"> <p>Many nonfree apps have a surveillance feature for <a href="https://techcrunch.com/2019/02/06/iphone-session-replay-screenshots/"> recording all the users' actions</a> in interacting with the app.</p> </li> <li id="M201902010"> <p>An investigation of the 150 most popular gratis VPN apps in Google Play found that <a href="https://www.top10vpn.com/free-vpn-android-app-risk-index/"> 25% fail to protect their users' privacy</a> due to DNS leaks. In addition, 85% feature intrusive permissions or functions in their source code—often used for invasive advertising—that could potentially also be used to spy on users. Other technical flaws were found as well.</p> <p>Moreover, a previous investigation had found that <a href="https://www.top10vpn.com/free-vpn-app-investigation/">half of the top 10 gratis VPN apps have lousy privacy policies</a>.</p> <p>It is unfortunate that these articles talk about “free apps.” These apps are gratis, but they are <em>not</em> <a href="/philosophy/free-sw.html">free software</a>.</p> </li> <li id="M201901050"> <p>The Weather Channel app <a href="https://www.theguardian.com/technology/2019/jan/04/weather-channel-app-lawsuit-location-data-selling"> stored users' locations to the company's server</a>. The company is being sued, demanding that it notify the users of what it will do with the data.</p> <p>I think that lawsuit is about a side issue. What the company does with the data is a secondary issue. The principal wrong here is that the company gets that data at all.</p> <p><a href="https://motherboard.vice.com/en_us/article/gy77wy/stop-using-third-party-weather-apps"> Other weather apps</a>, including Accuweather and WeatherBug, are tracking people's locations.</p> </li> <li id="M201812290"> <p>Around 40% of gratis Android apps <a href="https://privacyinternational.org/report/2647/how-apps-android-share-data-facebook-report"> report on the user's actions to Facebook</a>.</p> <p>Often they send the machine's “advertising ID,” so that Facebook can correlate the data it obtains from the same machine via various apps. Some of them send Facebook detailed information about the user's activities in the app; others only say that the user is using that app, but that alone is often quite informative.</p> <p>This spying occurs regardless of whether the user has a Facebook account.</p> </li> <li id="M201812060"> <p>Facebook's app got “consent” to <a href="https://www.theguardian.com/technology/2018/dec/06/facebook-emails-reveal-discussions-over-call-log-consent"> upload call logs automatically from Android phones</a> while disguising what the “consent” was for.</p> </li> <li id="M201810244"> <p>Some Android apps <a href="https://www.androidauthority.com/apps-uninstall-trackers-917539/amp/"> track the phones of users that have deleted them</a>.</p> </li> <li id="M201806110"> <p>The Spanish football streaming app <a href="https://boingboing.net/2018/06/11/spanish-football-app-turns-use.html">tracks the user's movements and listens through the microphone</a>.</p> <p>This makes them act as spies for licensing enforcement.</p> <p>I expect it implements DRM, too—that there is no way to save a recording. But I can't be sure from the article.</p> <p>If you learn to care much less about sports, you will benefit in many ways. This is one more.</p> </li> <li id="M201804160"> <p>More than <a href="https://www.theguardian.com/technology/2018/apr/16/child-apps-games-android-us-google-play-store-data-sharing-law-privacy">50% of the 5,855 Android apps studied by researchers were found to snoop and collect information about its users</a>. 40% of the apps were found to insecurely snitch on its users. Furthermore, they could detect only some methods of snooping, in these proprietary apps whose source code they cannot look at. The other apps might be snooping in other ways.</p> <p>This is evidence that proprietary apps generally work against their users. To protect their privacy and freedom, Android users need to get rid of the proprietary software—both proprietary Android by <a href="https://replicant.us">switching to Replicant</a>, and the proprietary apps by getting apps from the free software only <a href="https://f-droid.org/">F-Droid store</a> that <a href="https://f-droid.org/wiki/page/Antifeatures"> prominently warns the user if an app contains anti-features</a>.</p> </li> <li id="M201804020"> <p>Grindr collects information about <a href="https://www.commondreams.org/news/2018/04/02/egregious-breach-privacy-popular-app-grindr-supplies-third-parties-users-hiv-status"> which users are HIV-positive, then provides the information to companies</a>.</p> <p>Grindr should not have so much information about its users. It could be designed so that users communicate such info to each other but not to the server's database.</p> </li> <li id="M201803050"> <p>The moviepass app and dis-service spy on users even more than users expected. It <a href="https://techcrunch.com/2018/03/05/moviepass-ceo-proudly-says-the-app-tracks-your-location-before-and-after-movies/">records where they travel before and after going to a movie</a>.</p> <p>Don't be tracked—pay cash!</p> </li> <li id="M201711240"> <p>Tracking software in popular Android apps is pervasive and sometimes very clever. Some trackers can <a href="https://theintercept.com/2017/11/24/staggering-variety-of-clandestine-trackers-found-in-popular-android-apps/"> follow a user's movements around a physical store by noticing WiFi networks</a>.</p> </li> <li id="M201711230"> <p>AI-powered driving apps can <a href="https://motherboard.vice.com/en_us/article/43nz9p/ai-powered-driving-apps-can-track-your-every-move"> track your every move</a>.</p> </li> <li id="M201708270"> <p>The Sarahah app <a href="https://theintercept.com/2017/08/27/hit-app-sarahah-quietly-uploads-your-address-book/"> uploads all phone numbers and email addresses</a> in user's address book to developer's server. Note that this article misuses the words “<a href="/philosophy/free-sw.html">free software</a>” referring to zero price.</p> </li> <li id="M201707270"> <p>20 dishonest Android apps recorded <a href="https://arstechnica.com/information-technology/2017/07/stealthy-google-play-apps-recorded-calls-and-stole-e-mails-and-texts">phone calls and sent them and text messages and emails to snoopers</a>.</p> <p>Google did not intend to make these apps spy; on the contrary, it worked in various ways to prevent that, and deleted these apps after discovering what they did. So we cannot blame Google specifically for the snooping of these apps.</p> <p>On the other hand, Google redistributes nonfree Android apps, and therefore shares in the responsibility for the injustice of their being nonfree. It also distributes its own nonfree apps, such as Google Play, <a href="/philosophy/free-software-even-more-important.html">which are malicious</a>.</p> <p>Could Google have done a better job of preventing apps from cheating? There is no systematic way for Google, or Android users, to inspect executable proprietary apps to see what they do.</p> <p>Google could demand the source code for these apps, and study the source code somehow to determine whether they mistreat users in various ways. If it did a good job of this, it could more or less prevent such snooping, except when the app developers are clever enough to outsmart the checking.</p> <p>But since Google itself develops malicious apps, we cannot trust Google to protect us. We must demand release of source code to the public, so we can depend on each other.</p> </li> <li id="M201705230"> <p>Apps for BART <a href="https://web.archive.org/web/20171124190046/https://consumerist.com/2017/05/23/passengers-say-commuter-rail-app-illegally-collects-personal-user-data/"> snoop on users</a>.</p> <p>With free software apps, users could <em>make sure</em> that they don't snoop.</p> <p>With proprietary apps, one can only hope that they don't.</p> </li> <li id="M201705040"> <p>A study found 234 Android apps that track users by <a href="https://www.bleepingcomputer.com/news/security/234-android-applications-are-currently-using-ultrasonic-beacons-to-track-users/">listening to ultrasound from beacons placed in stores or played by TV programs</a>.</p> </li> <li id="M201704260"> <p>Faceapp appears to or watching</a>. In addition, do lots of surveillance, judging by <a href="https://www.washingtonpost.com/news/the-intersect/wp/2017/04/26/everything-thats-wrong-with-faceapp-the-latest-creepy-photo-app-for-your-face/"> how much access it may be analyzing people's conversations demands to serve them personal data in the device</a>.</p> </li> <li id="M201704190"> <p>Users are suing Bose for <a href="https://www.washingtonpost.com/news/the-switch/wp/2017/04/19/bose-headphones-have-been-spying-on-their-customers-lawsuit-claims/"> distributing a spyware app for its headphones</a>. Specifically, the app would record the names of the audio files users listen to along with targeted advertisements.</p> the headphone's unique serial number.</p> <p>The suit accuses that this was done without the users' consent. If the fine print of the app said that users gave consent for this, would that make it acceptable? No way! It should be flat out <a href="/philosophy/surveillance-vs-democracy.html"> illegal to design the app to snoop at all</a>.</p> </li> <li id="M201704074"> <p>Pairs of Android apps can collude to transmit users' personal data to servers. <a href="https://www.theatlantic.com/technology/archive/2017/04/when-apps-collude-to-steal-your-data/522177/">A study found tens of thousands of pairs that collude</a>.</p> </li> <li id="M201703300"> <p>Verizon <a href="https://yro.slashdot.org/story/17/03/30/0112259/verizon-to-force-appflash-spyware-on-android-phones"> announced an opt-in proprietary search app that it will</a> pre-install on some of its phones. The app will give Verizon the same information about the users' searches that Google normally gets when they use its search engine.</p> <p>Currently, the app is <a href="https://www.eff.org/deeplinks/2017/04/update-verizons-appflash-pre-installed-spyware-still-spyware"> being pre-installed on only one phone</a>, and the user must explicitly opt-in before the app takes effect. However, the app remains spyware—an “optional” piece of spyware is still spyware.</p> </li> <li id="M201701210"> <p>The Meitu photo-editing app <a href="https://theintercept.com/2017/01/21/popular-selfie-app-sending-user-data-to-china-researchers-say/">sends user data to a Chinese company</a>.</p> </li> <li id="M201611280"> <p>The Uber app tracks <a href="https://techcrunch.com/2016/11/28/uber-background-location-data-collection/">clients' movements before and after the ride</a>.</p> <p>This example illustrates how “getting the user's consent” for surveillance is inadequate as a protection against massive surveillance.</p> </li> <li> <li id="M201611160"> <p>A <a href="https://research.csiro.au/ng/wp-content/uploads/sites/106/2016/08/paper-1.pdf"> research paper</a> that investigated the privacy and security of 283 Android VPN apps concluded that “in spite of the promises for privacy, security, and anonymity given by the majority of VPN apps—millions of users may be unawarely subject to poor security guarantees and abusive practices inflicted by VPN apps.”</p> <p>Following is a non-exhaustive list list, taken from the research paper, of some proprietary VPN apps from the research paper that tracks track users and infringes the privacy of users:</p> <dl> infringe their privacy:</p> <dl class="compact"> <dt>SurfEasy</dt> <dd>Includes tracking libraries such as NativeX and Appflood, meant to track users and show them targeted ads.</dd> <dt>sFly Network Booster</dt> <dd>Requests the <code>READ_SMS</code> and <code>SEND_SMS</code> permissions upon installation, meaning it has full access to users' text messages.</dd> <dt>DroidVPN and TigerVPN</dt> <dd>Requests the <code>READ_LOGS</code> permission to read logs for other apps and also core system logs. TigerVPN developers have confirmed this.</dd> <dt>HideMyAss</dt> <dd>Sends traffic to LinkedIn. Also, it stores detailed logs and may turn them over to the UK government if requested.</dd> <dt>VPN Services HotspotShield</dt> <dd>Injects JavaScript code into the HTML pages returned to the users. The stated purpose of the JS injection is to display ads. Uses roughly 5 five tracking libraries. Also, it redirects the user's traffic through valueclick.com (an advertising website).</dd> <dt>WiFi Protector VPN</dt> <dd>Injects JavaScript code into HTML pages, and also uses roughly 5 five tracking libraries. Developers of this app have confirmed that the non-premium version of the app does JavaScript injection does JavaScript injection for tracking the user and displaying ads.</dd> </dl> </li> <li id="M201611150"> <p>Some portable phones <a href="http://www.prnewswire.com/news-releases/kryptowire-discovered-mobile-phone-firmware-that-transmitted-personally-identifiable-information-pii-without-user-consent-or-disclosure-300362844.html">are sold with spyware sending lots of data to China</a>.</p> </li> <li id="M201606050"> <p>Facebook's new Magic Photo app <a href="https://www.theregister.co.uk/2015/11/10/facebook_scans_camera_for_your_friends/"> scans your mobile phone's photo collections for tracking known faces</a>, and display ads.</dd> </dl> </li> <li> <p><a href="http://www.privmetrics.org/wp-content/uploads/2015/06/wisec2015.pdf">A study suggests you to share the picture you take according to who is in 2015</a> found that 90% of the top-ranked gratis proprietary Android apps contained recognizable tracking libraries. For frame.</p> <p>This spyware feature seems to require online access to some known-faces database, which means the paid proprietary apps, it was only 60%.</p> <p>The article confusingly describes gratis apps as “free”, but most pictures are likely to be sent across the wire to Facebook's servers and face-recognition algorithms.</p> <p>If so, none of them Facebook users' pictures are not in fact <a href="/philosophy/free-sw.html">free software</a>. It also uses private anymore, even if the ugly word “monetize”. A good replacement for that word is “exploit”; nearly always that will fit perfectly.</p> user didn't “upload” them to the service.</p> </li> <li> <p>A study found 234 Android apps that track users by <li id="M201605310"> <p>Facebook's app listens all the time, <a href="https://www.bleepingcomputer.com/news/security/234-android-applications-are-currently-using-ultrasonic-beacons-to-track-users/">listening href="http://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-using-people-s-phones-to-listen-in-on-what-they-re-saying-claims-professor-a7057526.html">to snoop on what people are listening to ultrasound from beacons placed in stores or played by TV programs</a>. </p> </li> <li> <p>Faceapp appears to do lots of surveillance, judging by <a href="https://www.washingtonpost.com/news/the-intersect/wp/2017/04/26/everything-thats-wrong-with-faceapp-the-latest-creepy-photo-app-for-your-face/"> how much access watching</a>. In addition, it demands may be analyzing people's conversations to personal serve them with targeted advertisements.</p> </li> <li id="M201604250"> <p>A pregnancy test controller application not only can <a href="http://www.theverge.com/2016/4/25/11503718/first-response-pregnancy-pro-test-bluetooth-app-security"> spy on many sorts of data in the device</a>. </p> </li> <li> <p>Pairs of Android apps phone, and in server accounts, it can collude to transmit users' personal data to servers. alter them too</a>.</p> </li> <li id="M201601130"> <p>Apps that include <a href="https://www.theatlantic.com/technology/archive/2017/04/when-apps-collude-to-steal-your-data/522177/">A study found tens of thousands href="https://web.archive.org/web/20180913014551/http://techaeris.com/2016/01/13/symphony-advanced-media-software-tracks-your-digital-life-through-your-smartphone-mic/"> Symphony surveillance software snoop on what radio and TV programs are playing nearby</a>. Also on what users post on various sites such as Facebook, Google+ and Twitter.</p> </li> <li id="M201601110"> <p>The natural extension of pairs that collude.</a></p> monitoring people through “their” phones is <a href="http://www.northwestern.edu/newscenter/stories/2016/01/fool-activity-tracker.html"> proprietary software to make sure they can't “fool” the monitoring</a>.</p> </li> <li> <p>Google Play intentionally sends app developers <li id="M201511190"> <p>“Cryptic communication,” unrelated to the app's functionality, was <a href="http://gadgets.ndtv.com/apps/news/google-play-store-policy-raises-privacy-concerns-331116"> href="http://news.mit.edu/2015/data-transferred-android-apps-hiding-1119"> found in the personal details of users 500 most popular gratis Android apps</a>.</p> <p>The article should not have described these apps as “free”—they are not free software. The clear way to say “zero price” is “gratis.”</p> <p>The article takes for granted that install the app</a>.</p> <p>Merely asking the “consent” of users usual analytics tools are legitimate, but is not enough that valid? Software developers have no right to legitimize actions like this. At this point, most analyze what users have stopped reading the “Terms and Conditions” are doing or how. “Analytics” tools that spell out what they snoop are “consenting” to. Google should clearly and honestly identify the information it collects on users, instead of hiding it in an obscurely worded EULA.</p> <p>However, to truly protect people's privacy, we must prevent Google and just as wrong as any other companies from getting this personal information in the first place!</p> snooping.</p> </li> <li> <p>Google Play (a component <li id="M201510300"> <p>More than 73% and 47% of Android) mobile applications, from Android and iOS respectively <a href="https://www.extremetech.com/mobile/235594-yes-google-play-is-tracking-you-and-thats-just-the-tip-of-a-very-large-iceberg"> tracks the users' movements without their permission</a>.</p> <p>Even if you disable Google Maps href="https://techscience.org/a/2015103001/">share personal, behavioral and location tracking, you must disable Google Play itself to completely stop the tracking. This is yet another example information</a> of nonfree software pretending to obey the user, when it's actually doing something else. Such a thing would be almost unthinkable their users with free software.</p> third parties.</p> </li> <li> <p>Verizon <li id="M201510050"> <p>According to Edward Snowden, <a href="https://yro.slashdot.org/story/17/03/30/0112259/verizon-to-force-appflash-spyware-on-android-phones"> announced an opt-in proprietary search app that it will</a> pre-install on some of its phones. The app will give Verizon the same information about the users' searches that Google normally gets when they use its search engine.</p> <p>Currently, href="http://www.bbc.com/news/uk-34444233">agencies can take over smartphones</a> by sending hidden text messages which enable them to turn the app is <a href="https://www.eff.org/deeplinks/2017/04/update-verizons-appflash-pre-installed-spyware-still-spyware"> being pre-installed phones on only one phone</a>, and off, listen to the user must explicitly opt-in before microphone, retrieve geo-location data from the app takes effect. However, GPS, take photographs, read text messages, read call, location and web browsing history, and read the app remains spyware—an “optional” piece of spyware contact list. This malware is still spyware.</p> </li> <li><p>The Meitu photo-editing app <a href="https://theintercept.com/2017/01/21/popular-selfie-app-sending-user-data-to-china-researchers-say/">sends user data designed to a Chinese company</a>.</p></li> <li> <p>A half-blind security critique of a tracking app: disguise itself from investigation.</p> </li> <li id="M201508210"> <p>Like most “music screaming” disservices, Spotify is based on proprietary malware (DRM and snooping). In August 2015 it found that <a href="http://www.consumerreports.org/mobile-security-software/glow-pregnancy-app-exposed-women-to-privacy-threats/"> blatant flaws allowed anyone href="http://www.theguardian.com/technology/2015/aug/21/spotify-faces-user-backlash-over-new-privacy-policy"> demanded users submit to snoop on a user's personal data</a>. The critique fails entirely increased snooping</a>, and some are starting to express concern realize that it is nasty.</p> <p>This article shows the app sends the personal data to <a href="https://www.theregister.co.uk/2015/08/21/spotify_worse_than_the_nsa/"> twisted ways that they present snooping as a server, where the <em>developer</em> gets it all. way to “serve” users better</a>—never mind whether they want that. This “service” is for suckers!</p> <p>The server surely has a “privacy policy,” and surely it is worthless since nearly all typical example of them are.</p> the attitude of the proprietary software industry towards those they have subjugated.</p> <p>Out, out, damned Spotify!</p> </li> <li><p>Apps that include <li id="M201507030"> <p>Samsung phones come with <a href="http://techaeris.com/2016/01/13/symphony-advanced-media-software-tracks-your-digital-life-through-your-smartphone-mic/"> Symphony surveillance software snoop on what radio and TV programs are playing nearby</a>. Also on what href="http://arstechnica.com/gadgets/2015/07/samsung-sued-for-loading-devices-with-unremovable-crapware-in-china/">apps that users post on various sites such as Facebook, Google+ can't delete</a>, and Twitter.</p> they send so much data that their transmission is a substantial expense for users. Said transmission, not wanted or requested by the user, clearly must constitute spying of some kind.</p> </li> <li><p>More than 73% and 47% <li id="M201506264"> <p><a href="http://www.privmetrics.org/wp-content/uploads/2015/06/wisec2015.pdf">A study in 2015</a> found that 90% of mobile applications, both from the top-ranked gratis proprietary Android apps contained recognizable tracking libraries. For the paid proprietary apps, it was only 60%.</p> <p>The article confusingly describes gratis apps as “free”, but most of them are not in fact <a href="/philosophy/free-sw.html">free software</a>. It also uses the ugly word “monetize”. A good replacement for that word is “exploit”; nearly always that will fit perfectly.</p> </li> <li id="M201505060"> <p>Gratis Android and iOS respectively apps (but not <a href="http://jots.pub/a/2015103001/index.php">share personal, behavioral href="/philosophy/free-sw.html">free software</a>) connect to 100 <a href="http://www.theguardian.com/technology/2015/may/06/free-android-apps-connect-tracking-advertising-websites">tracking and location information</a> of their users with third parties.</p> advertising</a> URLs, on the average.</p> </li> <li><p>“Cryptic communication,” unrelated <li id="M201504060"> <p>Widely used <a href="https://freedom-to-tinker.com/blog/kollarssmith/scan-this-or-scan-me-user-privacy-barcode-scanning-applications/">proprietary QR-code scanner apps snoop on the user</a>. This is in addition to the app's functionality, was <a href="http://news.mit.edu/2015/data-transferred-android-apps-hiding-1119"> found snooping done by the phone company, and perhaps by the OS in the 500 most popular gratis Android apps</a>.</p> <p>The article should not have described these apps as “free”—they are not free software. The clear way phone.</p> <p>Don't be distracted by the question of whether the app developers get users to say “zero price” “I agree”. That is “gratis.”</p> <p>The article takes no excuse for granted that malware.</p> </li> <li id="M201411260"> <p>Many proprietary apps for mobile devices report which other apps the usual analytics tools are legitimate, but user has installed. <a href="http://techcrunch.com/2014/11/26/twitter-app-graph/">Twitter is that valid? Software developers have no right to analyze what users are doing or how. “Analytics” tools this in a way that snoop are just at least is visible and optional</a>. Not as wrong bad as what the others do.</p> </li> <li id="M201403120"> <p><a href="/proprietary/proprietary-back-doors.html#samsung"> Samsung's back door</a> provides access to any file on the system.</p> </li> <li id="M201401150.1"> <p>The Simeji keyboard is a smartphone version of Baidu's <a href="/proprietary/proprietary-surveillance.html#baidu-ime">spying <abbr title="Input Method Editor">IME</abbr></a>.</p> </li> <li id="M201312270"> <p>The nonfree Snapchat app's principal purpose is to restrict the use of data on the user's computer, but it does surveillance too: <a href="http://www.theguardian.com/media/2013/dec/27/snapchat-may-be-exposed-hackers"> it tries to get the user's list of other snooping.</p> people's phone numbers</a>.</p> </li> <li><p>Many proprietary apps <li id="M201312060"> <p>The Brightest Flashlight app <a href="http://www.theguardian.com/technology/2013/dec/06/android-app-50m-downloads-sent-data-advertisers"> sends user data, including geolocation, for mobile devices report which use by companies</a>.</p> <p>The FTC criticized this app because it asked the user to approve sending personal data to the app developer but did not ask about sending it to other apps companies. This shows the user has installed. <a href="http://techcrunch.com/2014/11/26/twitter-app-graph/">Twitter is doing this in a way that at least is visible and optional</a>. Not as bad as what weakness of the others do.</p> reject-it-if-you-dislike-snooping “solution” to surveillance: why should a flashlight app send any information to anyone? A free software flashlight app would not.</p> </li> <li><p>Portable <li id="M201307000"> <p>Portable phones with GPS <a href="http://www.aclu.org/government-location-tracking-cell-phones-gps-devices-and-license-plate-readers"> will send their GPS location on remote command command, and users cannot stop them: <a href="http://www.aclu.org/government-location-tracking-cell-phones-gps-devices-and-license-plate-readers"> http://www.aclu.org/government-location-tracking-cell-phones-gps-devices-and-license-plate-readers</a>. them</a>. (The US says it will eventually require all new portable phones to have GPS.)</p> </li> <li><p>Spyware in Cisco TNP IP phones: <a href="http://boingboing.net/2012/12/29/your-cisco-phone-is-listening.html"> http://boingboing.net/2012/12/29/your-cisco-phone-is-listening.html</a>.</p></li> <li><p>Spyware in Android phones (and Windows? laptops): The Wall Street Journal (in an article blocked from us by a paywall) reports that <a href="http://www.theverge.com/2013/8/1/4580718/fbi-can-remotely-activate-android-and-laptop-microphones-reports-wsj"> the FBI can remotely activate the GPS and microphone in Android phones and in laptops</a>. (I suspect this means Windows laptops.) Here is <a href="http://cryptome.org/2013/08/fbi-hackers.htm">more info</a>.</p> </li> <li><p>Some Motorola phones modify Android to <li id="M201212100"> <p>FTC says most mobile apps for children don't respect privacy: <a href="http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html"> send personal data to Motorola.</a></p> href="http://arstechnica.com/information-technology/2012/12/ftc-disclosures-severely-lacking-in-kids-mobile-appsand-its-getting-worse/"> http://arstechnica.com/information-technology/2012/12/ftc-disclosures-severely-lacking-in-kids-mobile-appsand-its-getting-worse/</a>.</p> </li> <li><p>Some <li id="M201111170"> <p>Some manufacturers add a <a href="http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/"> hidden general surveillance package such as Carrier IQ.</a></p> </li> <li><p>Widely used <a href="https://freedom-to-tinker.com/blog/kollarssmith/scan-this-or-scan-me-user-privacy-barcode-scanning-applications/">proprietary QR-code scanner apps snoop on the user</a>. This is in addition to the snooping done by the phone company, and perhaps by the OS in the phone.</p> <p>Don't be distracted by the question of whether the app developers get users to say “I agree”. That is no excuse for malware.</p> </li> </ul> <h3 id="drm">Mobile DRM</h3> <ul> <li id="android-apps-detect-rooting"> <p>Google now allows Android apps to detect whether a device has been rooted, <a href="http://www.androidpolice.com/2017/05/13/netflix-confirms-blocking-rootedunlocked-devices-app-still-working-now/">and refuse to install if so</a>.</p> <p>Update: Google <i>intentionally</i> <a href="https://torrentfreak.com/netflix-use-of-google-drm-means-rooted-android-devices-are-banned-170515/"> changed Android so that apps can detect rooted devices and refuse to run on them</a>.</p> </li> <li> <p>The iPhone 7 contains DRM specifically designed to <a href="https://motherboard.vice.com/en_us/article/iphone-7-home-button-unreplaceable-repair-software-lock"> brick it if an “unauthorized” repair shop fixes it</a>. “Unauthorized” essentially means anyone besides Apple.</p> <p>The article uses the term “lock” to describe the DRM, but we prefer to use the term <a href="https://gnu.org/philosophy/words-to-avoid.html#DigitalLocks"> digital handcuffs</a>.</p> </li> <li><p>Android <a href="https://developer.android.com/reference/android/drm/package-summary.html">contains facilities specifically to support DRM</a>.</p> IQ</a>.</p> </li> </ul> <h3 id="jails">Mobile Jails</h3> <ul> <li><p><a href="https://fsf.org/campaigns/secure-boot-vs-restricted-boot/">Mobile devices that come with <ul class="blurbs"> <li id="M201210080"> <p><a href="https://www.itworld.com/article/2832657/microsoft-metro-app-store-lock-down.html"> Windows 8 are tyrants</a>. <a href="http://www.itworld.com/article/2832657/operating-systems/microsoft-metro-app-store-lock-down.html">Windows 8 on “mobile devices” is (now defunct) was a jail.</a></p> jail</a>.</p> </li> </ul> <h3 id="tyrants">Mobile Tyrants</h3> <ul> <li><p><a href="http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html"> Some Android phones are tyrants</a> (though someone found a way to crack the restriction). Fortunately, most Android <ul class="blurbs"> <li id="M201110110"> <p><a href="https://fsf.org/campaigns/secure-boot-vs-restricted-boot/"> Mobile devices that come with Windows 8 are not tyrants.</p> tyrants</a>.</p> </li> </ul> </div><!-- for id="content", starts in the include above --> <!--#include virtual="/server/footer.html" --> <div id="footer"> <div class="unprintable"> <p>Please send general FSF & GNU inquiries to <a href="mailto:gnu@gnu.org"><gnu@gnu.org></a>. There are also <a href="/contact/">other ways to contact</a> the FSF. Broken links and other corrections or suggestions can be sent to <a href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>.</p> <p><!-- TRANSLATORS: Ignore the original text in this paragraph, replace it with the translation of these two: We work hard and do our best to provide accurate, good quality translations. However, we are not exempt from imperfection. Please send your comments and general suggestions in this regard to <a href="mailto:web-translators@gnu.org"> <web-translators@gnu.org></a>.</p> <p>For information on coordinating and submitting translations of our web pages, see <a href="/server/standards/README.translations.html">Translations README</a>. --> Please see the <a href="/server/standards/README.translations.html">Translations README</a> for information on coordinating and submitting translations of this article.</p> </div> <!-- Regarding copyright, in general, standalone pages (as opposed to files generated as part of manuals) on the GNU web server should be under CC BY-ND 4.0. Please do NOT change or remove this without talking with the webmasters or licensing team first. Please make sure the copyright date is consistent with the document. For web pages, it is ok to list just the latest year the document was modified, or published. If you wish to list earlier years, that is ok too. Either "2001, 2002, 2003" or "2001-2003" are ok for specifying years, as long as each year in the range is in fact a copyrightable year, i.e., a year in which the document was published (including being publicly visible on the web or in a revision control system). There is more detail about copyright years in the GNU Maintainers Information document, www.gnu.org/prep/maintain. --> <p>Copyright © 2014, 2015, 2016, 2017 2017, 2018, 2019 Free Software Foundation, Inc.</p> <p>This page is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nd/4.0/">Creative href="http://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution-NoDerivatives Attribution 4.0 International License</a>.</p> <!--#include virtual="/server/bottom-notes.html" --> <p class="unprintable">Updated: <!-- timestamp start --> $Date: 2019/06/11 12:01:40 $ <!-- timestamp end --> </p> </div> </div> </div><!-- for class="inner", starts in the banner include --> </body> </html> ...
http://www.gnu.org/savannah-checkouts/gnu/www/proprietary/po/malware-mobiles.it-diff.html - [detail] - [similar]
PREV NEXT
Powered by Hyper Estraier 1.4.13, with 213332 documents and 1081104 words.