2

A friend is concerned their phone may have spyware on it. A quick search on the web returns a lot of results for software/apps that you can buy to spy on someone's cell. Based on researching this topic and various software, it's my belief you do need access to the cell for any spyware to work. My friend disagrees.

I'm not trying to start a debate; I'm sincerely interested in hearing from a community that has security experts. I would like to allay my friend's fears. Please let me know if I posted this in the wrong stackexchange.

| improve this question | |
  • Most spyware requires giving permissions through an app the user downloads, unless your friend is the victim of a an exploit to get around the OS permissions framework, which is highly unlikely. Some tips to chill your friend out - make sure their phone is up to date, have them go through their apps and look at what has permissions especially apps you dont recognize, make sure the phone has "only download from secure sources" turned on. If the phone is still exhibiting sketchy behaviour, back up valueable content (photos/contacts) and reformat it. – essefbx Feb 16 '17 at 23:33
  • My post may have been slightly confusing. I was referring to the apps you can buy to spy on people's phones. Not spyware hidden in downloaded apps. My friend has followed all those steps. The question is whether an app that lets you spy on someone through their cell phone requires physical access to the phone. – AmyW Feb 17 '17 at 13:59
3

I'm not an expert either so I can only give generalities.

Installing a spyware remotely is likely much harder than with physical access to the phone. In the latter case, you're totally screwed : physical access is total access.

If the phone is away, the only option would be to break into it, using an OS vulnerability. It's totally possible as no system is totally secure, but these usually require an action from the user, therefore good security practices will most likely prevent this.

Namely, ignore any link or attachment coming from emails, or unknown or obviously hacked phone numbers/social media accounts/messaging service accounts : these can try to exploit vulnerabilities in your browser or in other parts of the OS.

Emails are easy to spoof, SMS likely harder, but I wouldn't trust them either ; social medias are usually better secured but client vulnerabilities, weak passwords or social engineering can allow someone to break into accounts anyway. Therefore, if you have a doubt, stay safe.

A more worrying problem is the lack of software updates. Most Android phones have outdated Android versions because the manufacturer doesn't care. You don't have a lot of options here : choose a model that's regularly updated like Google's Nexus/Pixel lines, or use an iPhone, as Apple typically updates its devices pretty quickly and supports them for years.

Also, forget jailbreaking, and stick to well-known apps in Google's or Apple's application stores. These are well reviewed and very likely not malicious.

TL;DR It's possible and been seen before, but usually requires user mistakes, and good practices can likely prevent it.

| improve this answer | |
  • My friend has an iPhone, and does keep the software up to date. She has received some odd text messages, but doesn't open them since there are ways to send a virus via SMS. She doesn't open emails from unknown sources. I realize it's possible people can send you viruses through email and SMS. What I'm unsure of is whether a person can buy an app that allows you to spy on another person's phone withot needing physical access. I don't believe that it's possible, but am also not the most knowledgable on this topic. – AmyW Feb 17 '17 at 14:22
  • Good answer. I would like to add that you should always verify the checksum of a downloaded app. It is entirely possible to infect your device via MiTM where legit packets are replaced by malicious ones and in the end you get a malware for what you thought was a completely legit app from a trusted source. Also, avoid public wifi at all costs unless you know what you're doing and disable auto connect to any avaliable access point to prevent associating with airbases. And no, a person cannot just buy an app and spy on you although it has to be said that you can be tracked via cells radio signal. – user633551 Feb 18 '17 at 12:29
  • @AmyW As I said in the answer, the only option to do this without physical access is to hack into the phone. I covered the case where the attacker isn't sophisticated enough not to need a user mistake. Hacking into an up-to-date Android/iOS phone without user action is way harder, requires a much more sophisticated attacker, and is only a concern if your adversary is state-sponsored or someone with the knowledge of a security researcher, not a spyware you can buy from some company ; moreover, I suspect that most consumer OSes are beyond help against these persons. – Hey Feb 18 '17 at 15:57
  • @user633551 these are good advice too, but apply only in rare cases where the attacker can MiTM Google's or Apple's app store, which likely already use checksums as well as TLS. If that's the case, there's not much you can do on your side. Also, I'm not sure it's possible to verify the checksums of downloaded apps on the Play Store or the App Store. – Hey Feb 18 '17 at 16:01
  • Thank you @Ydob-Emos and @user633551! I didn't think it was possible without physical access, but wanted to ask someone more knowledgeable. – AmyW Feb 21 '17 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.