claim: Flashlight apps harbor furtive code to steal your personal data and send it to foreign cybercriminals.
origin: On 1 October 2014, cybersecurity company SnoopWall released a â€œthreat assessment reportâ€ discussing flashlight apps for Android devices and security threats they may pose. Although the report was released to the accompaniment of alarmist news stories about how some flashlight apps could potentially access banking information and cell phone video cameras and send usersâ€™ personal information to cybercriminals abroad in India, China, and Russia, the SnoopWall report itself neither stated nor offered evidence that such activity was taking place. That report merely charted the permissions accessed by the top ten Android flashlight apps and offered some tips about â€œbest practices for increasing privacy and security on your device without spending any money.â€ It is indeed the case that a number of flashlight apps can and do request access to permissions and data on usersâ€™ cell phones that seemingly has nothing to do with the ordinary functioning of the app, and that such permissions could theoretically enable criminals to obtain sensitive personal information from cell phone users. However: As the Daily Dot observed of the hysteria generated by SnoopWallâ€™s report, it all appeared to be part of a calculated fear-driven marketing ploy for SnoopWallâ€™s own products: < It all sounds pretty scary, but before you go culling your flashlight apps in one massive purge you should know that thereâ€™s very little to fear. While SnoopWallâ€™s report makes things sound pretty dire, the company offers no actual proof that these apps are a threat to your personal security or â€” in the worst possible case â€” a danger to national security. Not one single shred of evidence is presented to support the companyâ€™s claims because none actually exists. SnoopWall itself has been pushing its own flashlight app (as a replacement for all the ones that are trying to overthrow the U.S. government, naturally) and the oddly named Privacy App which is designed to highlight any other apps on your Android device that are a security risk and could do you harm. The end goal here is to score licensing deals with app makers to include the companyâ€™s Privacy Shield software in their own apps. Just like the flashlight apps using you as ad fodder, SnoopWall wants your support which it can leverage in order to pay the bills. Companies need paychecks too, after all. But thatâ€™s not the only thing that appears a bit hypocritical about SnoopWallâ€™s agressive attack against â€œdishonestâ€ app developers. In researching SnoopWallâ€™s generically named Privacy App I found that users almost universally agree that the app simply doesnâ€™t work. While the app promises to â€œfind all the apps that are spying on you,â€ the user reviews suggest itâ€™s not doing much good. The entire front page of the appâ€™s Google Play listing is filled with reviews saying that the app produces nothing but false positives > SnoopWallâ€™s â€œthreat assessment reportâ€ suggested that flashlight apps are more prone to requesting access to unneeded permissions and data than any other category of app, but as Wired noted, many other types of apps â€œwant access to information they probably shouldnâ€™t,â€ and the fact that a given app has access to data doesnâ€™t necessarily mean the app is actually stealing that data and transmitting it to internatonal cybercriminals. It may be the case, though, that youâ€™re paying for your â€œfreeâ€ app by unwittingly allowing your personal data to be shared with marketers: < The Flashlight app on my phone is built by a company called iHandy. [A] mobile phone security operation called Appthority did an analysis of the data that Flashlight can potentially request, and itâ€™s pretty scary. According to Appthorityâ€™s president, Domingo Guerra, Flashlight is designed to do location tracking, read my calendar, use my camera, gain access to unique numbers that identify my phone, and then share data with a number of ad networks, including Googleâ€™s AdMob, iAd, and JumpTap. It may not actually be doing all of these things â€” Appthorityâ€™s analysis only shows what the software is capable of, not necessarily what itâ€™s actually up to â€” but the fact that thereâ€™s such an arsenal of dubious uses should raise eyebrows. On my phone, several apps want access to information they probably shouldnâ€™t, and odds are, thatâ€™s the case with your phone, too. The lesson here is that when it comes to mobile software, thereâ€™s really no such thing as a free app. > All in all, as the Guardian noted, â€œdevelopers are often asking for far greater power over a userâ€™s device, in order to collect data and sell it on to marketers and ad networks. Itâ€™s the latest reminder that if youâ€™re not paying for an app, its business model may well involve selling your data.â€ Or, as Jeff Werner of the Northwest Florida Daily News observed: < Personally, Iâ€™m inclined to believe that there are apps out there that are sending personal data to places where that data has no business going, [but] I would be surprised if it was limited to flashlight apps. At the end of the day, itâ€™s important for you to make your own decisions. Be informed, but donâ€™t believe every last thing you see or read on the Internet. When it comes to your smartphone, because of the unique nature of the data it contains, and the sites that many of us access with it, be very careful which apps you choose to install. The fewer apps you select, and the more mainstream they are, the less vulnerable you will be to theft of your data. > One flashlight app developer, Goldenshores Technologies (makers of the â€œBrightest Flashlightâ€ app for Android), settled a complaint with the FTC in 2014 over their collecting location data and unique device IDs from usersâ€™ devices and sharing that data with advertisers. So when it comes to apps â€” even â€œfree onesâ€ â€” caveat emptor.