6 ms·

Android App Secretly Forwards Text Messages

41 points by J3L2404 16y ago

alanh 16y ago
> “We can’t build it for the iPhone because it wouldn’t make it past the App Store approval process,” Mr. Tanjeloff said. The app is, by definition, spyware. It secretly, continuously forwards all SMS messages to a third party, and “there is no visible icon or shortcut to access it.” It’s like an ad for iPhone.
- stevenwei 16y ago
  I wonder how long it'll take for an exploit to come along that automatically installs this type of stuff on people's phones?
- johnrob 16y ago
  It may be spyware, but I'd still like the option of installing it if I want to. Nobody every said freedom came without flaws.
  - the-kenny 16y ago
    You could install it, Android allows software installation without the Market. It should just not get distributed through the Market. It's Spyware.
  - thwarted 16y ago
    It's more of a tradeoff or limit than a flaw. Flaw implies, in some sense, that flawless and perfection is possible.
- deleted 16y ago
  [deleted]
- yanw 16y ago
  I'm the only one who knows the password + swipe pattern to unlock my phone so I'm the only one who installs apps on it, plus all apps are listed if you decide to check your installed app inventory.
- sprout 16y ago
  How difficult is it to jailbreak an iPhone, install a trojan, and then make it superficially at least unjailbroken? At the least steps 1 & 2 ought to be pretty easy.
  - jimbojohn 16y ago
    An up-to-date iPhone is not trivial to jailbreak, especially if it isn't yours. Jailbreaking is a specific kind of rooting. It "ought" to be virtually impossible. Then good luck hiding your trail, reassociating the Apple ID, hoping no apps broke due to the jailbreak (it's happened to me), keeping the device associated with the owner's iTunes, etc.
    - aikinai 16y ago
      There are times when jailbreaking an up-to-date iPhone is not possible, but right now the latest firmware can be rooted in a few minutes with a very simple program. It does not affect your Apple ID, iTunes association or anything other apps. It just gives you root access and installs the jailbroken app store from which you can install OpenSSH, etc. I'm not sure if there are any trojans available, but if there were, you could easily install them and then either delete the jailbroken app store or just hide it from SpringBoard. This process could easily be done in 10-15 minutes as long as you have physical access to the phone.
- jamesbritt 16y ago
  " It secretly, continuously forwards all SMS messages to a third party, ..." It's only secret if you're not the one who installed it. I think of spyware as apps that claim to be for one thing but instead (or also) do some remote reporting that I, as the installer, would never approve of had I known. This, though, is called Secret SMS Replicator. If I had a need to spy on my children (perhaps I was concerned over who they might be texting) this would be quite handy.
  - alanh 16y ago
    It is unethical to use this software on one’s children without letting them know. Not to mention hypocritical if one’s purpose is moral instruction (in giving them a phone, its implied purpose is communication to parties of their choosing, not to someone and mom/dad; installing this software is deceitful). Some consider communication technology almost like “soft cybernetics.” By that line if thinking, secretly reading every SMS is like tapping into your children’s mind. This may be desirable but I would consider that a violation of their own right to privacy and personhood, and (mild) psychological abuse. But this whole discussion is on the usefulness of SMS forwarding, which is orthogonal to the security & privacy issues of the original article, and the implied endorsement of a quality App Store.
    - spokey 16y ago
      > It is unethical to use this software on one’s children without letting them know. I disagree. If you had written "spouse" or "significant other" or really any other adult I'd agree with you, but I don't think you can make that absolute statement when it comes to (minor) children. Letting the child know about the monitoring software would be the good and trusting thing to do, but "unethical" overstates the case significantly. I can imagine cases where it would reflect poor judgment or be inappropriate to snoop in this way, but I can readily imagine scenarios where it would be unethical NOT to secretly monitor a child's communication. Part of a parent's job is to keep their children out of trouble until the child is old enough to do that for themselves. (Another part, as you suggest, is teaching the child how to do just that.) Absolute statements about privacy kind of go out the window when you are talking about a relationship and responsibility of that nature. It is not hard to imagine a child (not every child, but certainly some, especially in the "tween" age range) that has the capacity and desire to hide some communication from his or her parents but lacking the judgment and life-skills to keep themselves safe from harm when doing so. Suppose your child is engaged in inappropriate or damaging behavior such bullying/being bullied, involved in self-harm/cutting, drug abuse, illegal activities, or things even more sinister. If your child has the desire to hide that activity from you, you could tell your child about the monitoring software but then they'll be careful to find another channel to communicate about this activity. Alternatively you could not tell them about the software and have some additional insight into their world whether they want you to have it or not. Look, it wouldn't be my first course of action, I wouldn't do it without provocation, and I would be very very careful how I made use of the information, but I wouldn't hesitate to violate my minor child's privacy if I thought it was important to protecting her well being. Monitoring text messages is nothing, I'd read her diary if necessary.
- mattmcknight 16y ago
  Yeah, on iPhone the spouse just needs access to your computer. http://www.iphone-sms.com/ http://www.iphone-sms.com/
  - alanh 16y ago
    Well that’s certainly an eye-opening use case of that software. I understand that setting the iTunes preference “Encrypt iPhone backups” and/or not allowing your spouse to log in as you would cover stop this. And deleting SMSes before syncing would also shield them from these, I assume.
irons 16y ago
For those who want to avoid having their text messages tapped, Mr. Tanjeloff suggested “keeping your phone close by, or make sure people trust you.” He really said that? Zoomed right past the event horizon of potential parody.
- deleted 16y ago
  [deleted]
- jamesaguilar 16y ago
  Is it really that outrageous? Seems like pretty down-to-earth advice to me.
  - irons 16y ago
    Bad enough if he'd said "make sure you trust the people who handle your phone", but he went full-bore, saying "make sure people trust you." He's preemptively blaming the victim — the person on whose phone his software runs. The lede for the article softpedals the degree of scumbaggery involved with the sale and use of this product. It's software for the domestic-abuser demographic.
the-kenny 16y ago
It's just spyware. It should be forbidden. If you think you need something like this in your relationship, your partner deserves something better than you. If you think your partner betrays you, talk to him/her.
- kenjackson 16y ago
  Not just your life partner, but people could use it with their manager, business partner, person you're interested in dating/stalking. Given that text messaging is the dominant means of communication for many people, it really becomes crucial that you don't let your phone out of your sight.
  - J3L2404 16y ago
    I assume it is intended to be used to spy on your children.
- pavel_lishin 16y ago
  Who decides whether it should be forbidden or not? What if I'm traveling to a high crime area? I might want to install this on my phone, to make recovery simpler in case someone steals it and starts messaging their friend bragging about their great new phone, and to meet them at Taco Bell in five minutes so they can show it off :)
  - martey 16y ago
    Google does. It seems pretty clear that it violates the Android Market Program policies, specifically the sections on impersonation, private information, and illegal activities: http://www.google.com/intl/en_us/mobile/android/market-policies.html http://www.google.com/intl/en_us/mobile/android/market-polic... I would expect Google to remove the app from the Market and any Android phones it was installed on. While your use of the program would be fine, the promotional video linked in the New York Times article makes it clear that the intended use is to spy on your significant other's cellphone. There are much easier ways to recover stolen phones than to install a program on it that will forward text messages to your non-stolen second phone, but good luck with that.
kenjackson 16y ago
Now someone just needs to write an app that monitors for this app. The malware/anti-malware wars have begun on Android!
- immad 16y ago
  Their is actually a virus scanning app that I installed just to see what it did. I like that is like the desktop and open enough to be abused. I prefer that to approval process based systems.
  - glhaynes 16y ago
    I like that is like the desktop and open enough to be abused. I prefer that to approval process based systems. I like that the choice is available (the world would be a poorer one if it didn't have such systems for people who want them), but this makes me just that much more happy with my iPhone. For me. Not that such a thing would be impossible with an iPhone, of course: someone could jailbreak it and install a similar app. But it'd certainly be harder and more time-consuming.
  - kenjackson 16y ago
    So did you try installing this app and see if it says something like, "App installed, but no shortcut/icon given... warning!"?
    - ni_nad 16y ago
      And what would happen if I tried to re-install Google's Sound Recorder app? Would I get the same message?
- eli 16y ago
  Norton has had an anti-virus product for Android for months. I think Kaspersky does as well.
  - mahmud 16y ago
    We don't want that crap on Android. Google should be doing static analysis on submitted binaries, dammit.
maukdaddy 16y ago
This app is certainly controversial, but can be helpful to people in relationships where this type of monitoring can be useful.” WTF does this say about our society? What an awful person.
- jdc 16y ago
  It says that we have conflicting, emotionally-driven interests.
cmelbye 16y ago
But Android is open!
gregable 16y ago
I initially thought this was going to be some rogue app that looks like a game, fart machine or something innocuous but behind the scenes sends your text messages to the developer. That would definitely be unfortunate and is a risk. Although if a fart machine app asks for access to your text messages and that doesn't cause you alarm, that's a separate issue. This is more of an issue of identity / authentication. The phone doesn't have any way of knowing that the "you" which installs the app isn't the "you" that is the primary user of the phone. The phone tries - it offers you a swipe code lock, you can even install other locking systems. Imagine if the app was not described as a marital eavesdropping tool but rather as a way to help you keep a record of your text messages that you can view via your account from your computer. It doesn't install an icon because there is no on-phone UI and the icon would just clutter the apps menu, a convenient feature to be sure. Same app, different story. The Google Voice app has a very similar idea.
pkaler 16y ago
It is illegal to wiretap someone else's phone. It is illegal to open someone else's mail. It is most likely illegal to install this App on someone else's phone.
- flogic 16y ago
  Can we be prosecuting them now please?
loganlinn 16y ago
Hopefully your partner doesn't forward your emails.
J3L2404 16y ago
"8:13 p.m. | Updated Adding that the app was pulled from the Android Market."
Sephr 16y ago
Just because you can commit wiretapping crimes with the application doesn't mean that the app is illegal and should be removed. It's not illegal for people to install this app on phones that they own, possibly for added security in case someone steals the phone and uses it to send text messages, or if you just want to log all of your text messages at one number. It's like removing a torrent application just because you can illegally pirate music with it. I oppose Google's decision to remove the application from the Android Market, as the application is appropriately labeled and does exactly what it says. It is not malware or spyware.
- irons 16y ago
  Who's asserting it's illegal? You seem to be setting up a straw man. Google should remove it because its use is unethical, and its continued presence is an indictment of the market's legitimacy.
phlux 16y ago
isnt that the same as cisco routers that secretly provide packet data to the NSA? Are we surprised? What about the AT&T closet that provides physical access to your backhaul? What about the google fiber to the home project?
buster 16y ago
The nice thing here is: The app already was pulled from the market. The market works (pretty much like wikipedia) through openness and a broad community to monitor it without heavy censorship from one vendor.
extension 16y ago
There is a whole category of apps like this for the BlackBerry -- apps that you deliberately install on a phone to spy on someone else who is using it. It is categorically different from conventional spyware because it doesn't misrepresent itself or do anything malicious to the user who installs it. If users are infiltrating each other's phones and spying on each other, that's between them. You may find it sleazy, but the developer isn't spying on anyone.

41 points by J3L2404 16y ago

alanh 16y ago

> “We can’t build it for the iPhone because it wouldn’t make it past the App Store approval process,” Mr. Tanjeloff said. The app is, by definition, spyware. It secretly, continuously forwards all SMS messages to a third party, and “there is no visible icon or shortcut to access it.” It’s like an ad for iPhone.

stevenwei 16y ago
I wonder how long it'll take for an exploit to come along that automatically installs this type of stuff on people's phones?
johnrob 16y ago
It may be spyware, but I'd still like the option of installing it if I want to. Nobody every said freedom came without flaws.
- the-kenny 16y ago
  You could install it, Android allows software installation without the Market. It should just not get distributed through the Market. It's Spyware.
- thwarted 16y ago
  It's more of a tradeoff or limit than a flaw. Flaw implies, in some sense, that flawless and perfection is possible.
deleted 16y ago
[deleted]
yanw 16y ago
I'm the only one who knows the password + swipe pattern to unlock my phone so I'm the only one who installs apps on it, plus all apps are listed if you decide to check your installed app inventory.
sprout 16y ago
How difficult is it to jailbreak an iPhone, install a trojan, and then make it superficially at least unjailbroken? At the least steps 1 & 2 ought to be pretty easy.
- jimbojohn 16y ago
  An up-to-date iPhone is not trivial to jailbreak, especially if it isn't yours. Jailbreaking is a specific kind of rooting. It "ought" to be virtually impossible. Then good luck hiding your trail, reassociating the Apple ID, hoping no apps broke due to the jailbreak (it's happened to me), keeping the device associated with the owner's iTunes, etc.
  - aikinai 16y ago
    There are times when jailbreaking an up-to-date iPhone is not possible, but right now the latest firmware can be rooted in a few minutes with a very simple program. It does not affect your Apple ID, iTunes association or anything other apps. It just gives you root access and installs the jailbroken app store from which you can install OpenSSH, etc. I'm not sure if there are any trojans available, but if there were, you could easily install them and then either delete the jailbroken app store or just hide it from SpringBoard. This process could easily be done in 10-15 minutes as long as you have physical access to the phone.
jamesbritt 16y ago
" It secretly, continuously forwards all SMS messages to a third party, ..." It's only secret if you're not the one who installed it. I think of spyware as apps that claim to be for one thing but instead (or also) do some remote reporting that I, as the installer, would never approve of had I known. This, though, is called Secret SMS Replicator. If I had a need to spy on my children (perhaps I was concerned over who they might be texting) this would be quite handy.
- alanh 16y ago
  It is unethical to use this software on one’s children without letting them know. Not to mention hypocritical if one’s purpose is moral instruction (in giving them a phone, its implied purpose is communication to parties of their choosing, not to someone and mom/dad; installing this software is deceitful). Some consider communication technology almost like “soft cybernetics.” By that line if thinking, secretly reading every SMS is like tapping into your children’s mind. This may be desirable but I would consider that a violation of their own right to privacy and personhood, and (mild) psychological abuse. But this whole discussion is on the usefulness of SMS forwarding, which is orthogonal to the security & privacy issues of the original article, and the implied endorsement of a quality App Store.
  - spokey 16y ago
    > It is unethical to use this software on one’s children without letting them know. I disagree. If you had written "spouse" or "significant other" or really any other adult I'd agree with you, but I don't think you can make that absolute statement when it comes to (minor) children. Letting the child know about the monitoring software would be the good and trusting thing to do, but "unethical" overstates the case significantly. I can imagine cases where it would reflect poor judgment or be inappropriate to snoop in this way, but I can readily imagine scenarios where it would be unethical NOT to secretly monitor a child's communication. Part of a parent's job is to keep their children out of trouble until the child is old enough to do that for themselves. (Another part, as you suggest, is teaching the child how to do just that.) Absolute statements about privacy kind of go out the window when you are talking about a relationship and responsibility of that nature. It is not hard to imagine a child (not every child, but certainly some, especially in the "tween" age range) that has the capacity and desire to hide some communication from his or her parents but lacking the judgment and life-skills to keep themselves safe from harm when doing so. Suppose your child is engaged in inappropriate or damaging behavior such bullying/being bullied, involved in self-harm/cutting, drug abuse, illegal activities, or things even more sinister. If your child has the desire to hide that activity from you, you could tell your child about the monitoring software but then they'll be careful to find another channel to communicate about this activity. Alternatively you could not tell them about the software and have some additional insight into their world whether they want you to have it or not. Look, it wouldn't be my first course of action, I wouldn't do it without provocation, and I would be very very careful how I made use of the information, but I wouldn't hesitate to violate my minor child's privacy if I thought it was important to protecting her well being. Monitoring text messages is nothing, I'd read her diary if necessary.
mattmcknight 16y ago
Yeah, on iPhone the spouse just needs access to your computer. http://www.iphone-sms.com/ http://www.iphone-sms.com/
- alanh 16y ago
  Well that’s certainly an eye-opening use case of that software. I understand that setting the iTunes preference “Encrypt iPhone backups” and/or not allowing your spouse to log in as you would cover stop this. And deleting SMSes before syncing would also shield them from these, I assume.

irons 16y ago

For those who want to avoid having their text messages tapped, Mr. Tanjeloff suggested “keeping your phone close by, or make sure people trust you.” He really said that? Zoomed right past the event horizon of potential parody.

deleted 16y ago
[deleted]
jamesaguilar 16y ago
Is it really that outrageous? Seems like pretty down-to-earth advice to me.
- irons 16y ago
  Bad enough if he'd said "make sure you trust the people who handle your phone", but he went full-bore, saying "make sure people trust you." He's preemptively blaming the victim — the person on whose phone his software runs. The lede for the article softpedals the degree of scumbaggery involved with the sale and use of this product. It's software for the domestic-abuser demographic.

the-kenny 16y ago

It's just spyware. It should be forbidden. If you think you need something like this in your relationship, your partner deserves something better than you. If you think your partner betrays you, talk to him/her.

kenjackson 16y ago
Not just your life partner, but people could use it with their manager, business partner, person you're interested in dating/stalking. Given that text messaging is the dominant means of communication for many people, it really becomes crucial that you don't let your phone out of your sight.
- J3L2404 16y ago
  I assume it is intended to be used to spy on your children.
pavel_lishin 16y ago
Who decides whether it should be forbidden or not? What if I'm traveling to a high crime area? I might want to install this on my phone, to make recovery simpler in case someone steals it and starts messaging their friend bragging about their great new phone, and to meet them at Taco Bell in five minutes so they can show it off :)
- martey 16y ago
  Google does. It seems pretty clear that it violates the Android Market Program policies, specifically the sections on impersonation, private information, and illegal activities: http://www.google.com/intl/en_us/mobile/android/market-policies.html http://www.google.com/intl/en_us/mobile/android/market-polic... I would expect Google to remove the app from the Market and any Android phones it was installed on. While your use of the program would be fine, the promotional video linked in the New York Times article makes it clear that the intended use is to spy on your significant other's cellphone. There are much easier ways to recover stolen phones than to install a program on it that will forward text messages to your non-stolen second phone, but good luck with that.

kenjackson 16y ago

Now someone just needs to write an app that monitors for this app. The malware/anti-malware wars have begun on Android!

immad 16y ago
Their is actually a virus scanning app that I installed just to see what it did. I like that is like the desktop and open enough to be abused. I prefer that to approval process based systems.
- glhaynes 16y ago
  I like that is like the desktop and open enough to be abused. I prefer that to approval process based systems. I like that the choice is available (the world would be a poorer one if it didn't have such systems for people who want them), but this makes me just that much more happy with my iPhone. For me. Not that such a thing would be impossible with an iPhone, of course: someone could jailbreak it and install a similar app. But it'd certainly be harder and more time-consuming.
- kenjackson 16y ago
  So did you try installing this app and see if it says something like, "App installed, but no shortcut/icon given... warning!"?
  - ni_nad 16y ago
    And what would happen if I tried to re-install Google's Sound Recorder app? Would I get the same message?
eli 16y ago
Norton has had an anti-virus product for Android for months. I think Kaspersky does as well.
- mahmud 16y ago
  We don't want that crap on Android. Google should be doing static analysis on submitted binaries, dammit.

maukdaddy 16y ago

This app is certainly controversial, but can be helpful to people in relationships where this type of monitoring can be useful.” WTF does this say about our society? What an awful person.

jdc 16y ago
It says that we have conflicting, emotionally-driven interests.

cmelbye 16y ago

But Android is open!

gregable 16y ago

I initially thought this was going to be some rogue app that looks like a game, fart machine or something innocuous but behind the scenes sends your text messages to the developer. That would definitely be unfortunate and is a risk. Although if a fart machine app asks for access to your text messages and that doesn't cause you alarm, that's a separate issue. This is more of an issue of identity / authentication. The phone doesn't have any way of knowing that the "you" which installs the app isn't the "you" that is the primary user of the phone. The phone tries - it offers you a swipe code lock, you can even install other locking systems. Imagine if the app was not described as a marital eavesdropping tool but rather as a way to help you keep a record of your text messages that you can view via your account from your computer. It doesn't install an icon because there is no on-phone UI and the icon would just clutter the apps menu, a convenient feature to be sure. Same app, different story. The Google Voice app has a very similar idea.

pkaler 16y ago

It is illegal to wiretap someone else's phone. It is illegal to open someone else's mail. It is most likely illegal to install this App on someone else's phone.

flogic 16y ago
Can we be prosecuting them now please?

loganlinn 16y ago

Hopefully your partner doesn't forward your emails.

J3L2404 16y ago

"8:13 p.m. | Updated Adding that the app was pulled from the Android Market."

Sephr 16y ago

Just because you can commit wiretapping crimes with the application doesn't mean that the app is illegal and should be removed. It's not illegal for people to install this app on phones that they own, possibly for added security in case someone steals the phone and uses it to send text messages, or if you just want to log all of your text messages at one number. It's like removing a torrent application just because you can illegally pirate music with it. I oppose Google's decision to remove the application from the Android Market, as the application is appropriately labeled and does exactly what it says. It is not malware or spyware.

irons 16y ago
Who's asserting it's illegal? You seem to be setting up a straw man. Google should remove it because its use is unethical, and its continued presence is an indictment of the market's legitimacy.

phlux 16y ago

isnt that the same as cisco routers that secretly provide packet data to the NSA? Are we surprised? What about the AT&T closet that provides physical access to your backhaul? What about the google fiber to the home project?

buster 16y ago

The nice thing here is: The app already was pulled from the market. The market works (pretty much like wikipedia) through openness and a broad community to monitor it without heavy censorship from one vendor.

extension 16y ago

There is a whole category of apps like this for the BlackBerry -- apps that you deliberately install on a phone to spy on someone else who is using it. It is categorically different from conventional spyware because it doesn't misrepresent itself or do anything malicious to the user who installs it. If users are infiltrating each other's phones and spying on each other, that's between them. You may find it sleazy, but the developer isn't spying on anyone.