Consumer Apps - The Spy You Love

by Vikram Venkatasubramanian

The average user today has over 40 apps on their smartphone. Add on the apps on laptops, tablets, smart TVs, smart watches, etc, we very quickly run up to over a 100 apps that surround us across all of our devices.

Very often, whether we use them or not, these apps are still running in the background. They run to capture seemingly minute details about our daily lives and transmit them to back to not just the mothership but also other entities that the app maker may have a business relationship with. Our geo-location, our heart rate, what we browsed, what we searched for, what we listened to, what we watched, when we traveled, how fast we traveled and the list goes on.

That app you used to check for the best gas prices? Well, it may be selling your driving data to your insurance company.
That period tracking app may be selling your very sensitive information to companies to target you with ads.
Google recently issued a warning to their user base warning them that apps may be spying on them by listening, capturing images and more.

So, how bad is it really out there? Well, we wanted to find out too and we went ahead and did what well might be one of the biggest studies on app safety conducted on the internet. We studied over 1 million apps on EACH of the two most popular app stores. Below are some of the very shocking findings. A picture speaks a thousand words ...

While the major app store vendors have indeed gone to great lengths in recent months to delete malicious apps and apps that do not adhere to their app store terms, there is still a very large extent of oversight in terms of enforcement of some very simple things such as whether the apps include a meaningful privacy policy. Further, once an app is downloaded by a user, there is no active notification mechanism to let them know if that specific app or app maker have been found guilty of any violations. But most egregiously, the sharing of information by apps and app makers directly with third parties is simply not controlled at all, allowing for everyone from nation states to data brokers to have free reign over our most sensitive information.

So, what can we all do about it? Well, caveat emptor i.e. buyer beware. Research your app and app maker thoroughly. Check to see the following:

Research the app maker.
- Are they a reputable company?
- Do they issue patches and updates for their apps?
- Do they collect or sell or share your information with third parties or other companies?
- Do they have an enforceable privacy policy?
- Are they bound by the laws of your country or some other country?
Research the app:
- Is it ad driven or a paid app or both?
- Have there been prior revisions to the app?
- Have there been any prior reports of suspicious activity by other users of the app?
- Does the app need access to sensitive information or sensitive components of your device such as microphone, geo-location, camera, etc
- Does the app share or collect information from other apps on your device? If so, in what way?
- What privacy and security settings does the app offer? Does the app still function if it does not have access to certain kinds of information or components of your phone?
- If you are a Kavalan Standard user, make sure to check your 'Data Exposure Report' to see which apps and websites may have rights to access what kinds of your information:

We have said this before and we will say it again, developing a cyber hygiene muscle memory in every member of your family is a critical element of your cyber defense posture. Every app download is a walk in to a dark alley, the hair needs to stand up in the backs of our necks when we do it.