Your smartphone too can leak private information
Fromfingerprintstoretinascans, images, text, andotherdata— yourprivacyisunderthreat
What do you do when you buy a smartphone? Install Facebook and WhatsApp after the mandatory settings are put in place. While the next set of downloads involving third-party apps follows soon after, the catch is we rarely go through their permission policies.
Acloserlookatthepermissionpolicy ofoneofthemostcommonlyused applicationssuchasFacebook, for instance, revealsthatitasksforaccessto allofthesubscriber’scontactsand informationstoredinthehandset. Moreover, italsoseekstohaveaccessto thedevicecameraandtomakecalls, withoutinformingtheuser. While Facebookisaproprietaryapp, the ruleremainsthesameformany third-partyapplications, whose originandownershipremain unknowntomostofus.
At a time when data leaks from the Unique Identification Authority of India (UIDAI)— the body that maintains the Aadhaar data of over a billion Indians— are raising disturbing questions over the security of one’s personal information, breach of privacy can come from one’s handheld device. From biometric details such as fingerprints and retina scans to financial information such as credit card numbers and passwords— all may be up for sale if one’s handset is hacked.
And while the possibility of a mobile hack was of little concern a few years ago, that is no longer the case now. The falling price of the International Mobile Subscriber Identity (IMSI)-catcher and a flurry of other malwares have now changed the tide against common users. IMSI, for example, is today widely used (by hackers) to identify a user of a mobile network, making analysts and experts jittery.
Whileusersofalltypesofmobile handsetscanbetargetsofhacks, usersof openoperatingsystemssuchasAndroid, whichcompriseover80percentofall mobileusersgloballyandover90per centinIndia, aremostvulnerable. For example, thedatausedtoidentify iPhoneusersfortouchIDandfaceIDis convertedintomathematical representationsthatareencryptedand protectedbythesecureenclavefeature onthephone, whereitcannotbe accessedbyiOS(Appleoperating system) orotherapps. Itisalsonotstored onAppleserversorbackeduptoiCloud, makingitvirtuallyimpossibletoleak privatedata. Butthereisnosuchsecurity featureavailabletoAndroidusers, makingthempronetodataattacks.
According to Gurpal Singh, senior market analyst, IDC, risks of data theft on mobile phones are growing exponentially. “Any information stored in the mobile phone can be accessed from a remote location. Once a malware or advanced virus gets into the system, it can copy and send all information to the hackers. It can also enable the camera, forward text messages, redirect calls and send any files from the device, without the user even knowing about its activity,” he said.
Such incidents are not rare. According to anti-virus major Norton’s recent mobile survey, over a third or 34 per cent of mobile phone users in India have faced malware or virus attacks recently, followed by threats involving fraudulent access or misuse of credit card or bank account details (21 per cent). The share of people facing hacking and leakage of personal information is no less. Nearly one in five (19 per cent) mobile users’ privacy has been breached in recent months, the survey says.
As half the users (50 per cent) grant permission to send promotional texts and/or emails to application providers, the threat levels are only rising. The survey reveals that 47 per cent of users have granted access to their contacts in exchange for free apps. And close to 40 per cent have granted permission to access their camera, bookmarks, and browser history.
Experts say while the damage from leakage of personal data like images, documents, and financial details may still be compensated, once biometric data is compromised, the loss is irreparable. As an increasing number of smartphones now comes with added features such as fingerprint scanners and iris scanners, such biometric data stored in devices may land up in the hands of hackers. However, once lost, these cannot be changed to secure one’s identity unlike passwords and account details.
“Digital security is still an afterthought for many. Getting a new mobile phone scratched is more worrisome than the risk of having it infected by a virus. While desktops and laptops do get the attention they need for their security, mobile phones still have a long way to go in this aspect. It’s time individuals and businesses realised that viruses, malware, and Internet threats do not only prey on computers,” Sanjay Katkar, joint managing director and chief technology officer, Quick Heal Technologies, says.
Mobile hackers are turning their attention towards enterprises too. According to experts, with the rising acceptance of BYOD (Bring your own device), enterprises are also at risk of mobile threats, with employees accessing official data on their mobile phones. Giving such a device unrestricted access to personal and official information and leaving it exposed to infected websites, fake or malicious apps can only spell disaster.