Popular Android App Has Been Sharing 100m Users' Location And Device Data

[onehandle]

The Android app Brightest Flashlight has been installed between 50 million and 100 million times, averaging a 4.8 rating from more than 1 million reviews. Yet its customers might not be so happy to learn the app has been secretly recording and sharing their location and device ID information.

http://www.fastcompany.com/3023042/fast-feed/this-popular-flashlight-app-has-been-secretly-your-sharing-location-and-device-id

Life in the 'un-walled garden.'

[htuttle]

1. It states that it wants to access your location and personal information before you install it

That being said, I didn't notice it either (I skipped past it and just clicked Install, because I needed a flashlight app).

Uninstalling now, however...I should read those things more closely. So should a lot of people.

[hobbit709]

2. I read EVERY screen on anything I install before clicking Next or OK.

[RC]

3. And quite closely too.

There are some sneaky wordings and outright untruths on some install screens.

[hobbit709]

4. Yep. And revouninstaller is your friend.

[Blue_Tires]

9. +1

[LTR]

5. That app, for some reason, has been ranking pretty high on Play Store's "most downloaded" lists

And I really have no idea why. There are plenty of flashlight apps there, and many of them without all the crappy ads, added screen shortcuts, bloated size and outrageous permissions. I happen to use this one, Swiss Army Knife, which does the flashlight thing and much more without all the B.S.:

https://play.google.com/store/apps/details?id=com.digital_and_dreams.android.swiss_army_knife

As for requested permissions, it is important to see what each app wants and why. Flashlight apps do require camera access, but it certainly shouldn't be able to access your contacts list, text messages, etc.

I rooted my Android and use System Tuner to revoke certain unnecessary permissions and control auto startups. I also use AdAway to maintain a hosts file that blocks certain ad servers (NOTE: some apps may not operate properly after blocking ads, in which case, find a similar app in the Play Store).

[LTR]

6. Here are the permissions the app asks for

This app has access to these permissions:

Your location
approximate location (network-based)
precise location (GPS and network-based)
Network communication
view network connections
full network access
view Wi-Fi connections
Phone calls
read phone status and identity
Storage
modify or delete the contents of your USB storage
System tools
install shortcuts
uninstall shortcuts
read Home settings and shortcuts
test access to protected storage
Camera
take pictures and videos
Affects battery
control flashlight
prevent device from sleeping


Quite a lot of permissions for a simple flashlight app, don'tcha think? Why does a simple flashlight app need access to network, storage, phone logs and GPS?

Meanwhile, Swiss Army Knife, the app I mentioned in the previous post, asks for the following:

Camera
take pictures and videos
Affects battery
prevent device from sleeping
control vibration
control flashlight
Audio settings
change your audio settings


Certainly seems far more reasonable (as I mentioned before, they note that the app needs camera access to work, but it doesn't take pictures). And I get a leveler, unit converter, etc.

[moondust]

7. Is there a body that checks these things?

The meat inspectors of cyber privacy? I'm sure a lot of people do not read the fine print when installing apps.

[LTR]

8. Play Store does remove some apps that violate their TOS

Google has removed quite a bit of malware-infested and other abusive apps. They've also deleted apps that violated copyrights (I.e. video game clones). And they've even removed some adblockers for vague reasons unknown. I'm sure they would pay attention if enough users complained. Thing is, this app didn't get many.

I wonder if the developers were gaming the top app charts and reviews, as this app ain't all that great and there are countless better alternatives available. Boggles the mind that this app is more popular than Pandora and Instagram. Google needs to investigate..It's a good thing the FTC did.