Pierluigi Paganini February 27, 2018

Android P, is expected to include a neat feature that prevents apps running in the background from spying on you through the camera or microphone on your cell phone.

Do you cover the lens on your webcam to prevent someone from spying on you? You should, and it seems like every security vendor has a branded piece of plastic to take care of that for you — just ask.

Unfortunately, it isn’t as easy to cover the camera on your phone. You use it for many functions that aren’t video conferencing and it is constantly in and out of your pocket or bag. Anything you stick on the camera lens is unlikely to stay for long. Like most mobile security requirements, we are reliant on software and fortunately, Google is stepping up. The next version of the mobile OS, Android P, is expected to include a neat feature that prevents apps running in the background from spying on you through the camera or microphone on your cell phone.

In 2014, one of the surprising revelations from Edward Snowden was the NSA’s ability to spy on targets through cellphone microphones and cameras. By 2017, cellphone specific malware like Chrysaor, Lipizzan and SonicSpy provide the same capability to hackers. There are even “legitimate” applications marketed to concerned parents and partners who feel the need to keep tabs on their family members. The techniques and capabilities are now so commonplace, it isn’t just the paranoid that should be concerned — everyone who is cares about their privacy should consider the threats that exist in their cellphones.

Most often, the malicious software makes its way onto a cellphone under the guise of something the user actually wants. For example, one enterprising hacker started with the popular Telegram messaging application, added the SonicSpy malware and then distributed messaging software under a variety of different names. Users enjoyed the benefits of the messaging software they downloaded, unaware that it was also spying on everything they did. When installing the application, Android pops up a warning about the app requesting access to your camera microphone, contacts, etc. but this seems acceptable for a messaging application. The insidious part is that even if you think you have closed the messaging app, it is still running in the background — spying on you through the camera and microphone. This is the trick that Android P is going to resolve.

The folks at xdadevelopers who scrutinize all changes to Android Open Source Project (AOSP) code were the first ones to identify the changes and determine the impact as summarized in this blog post. When an application is installed on Android it is assigned an unchanging User ID (UID) which Android leverages the new privacy changes.

Kyle Wiggers explains, “In Android P, when the camera service detects that a UID is “idle”—that is to say, when the device is in the idle Doze state and background apps’ access to CPU and network-intensive services is restricted—Android will generate an error and close access to the camera. Subsequent camera requests from the inactive UID will immediately generate an error.”

In other words, your phone will tell you when an app you didn’t realize was running tries to access the camera. There are likely to be cases where you want to allow an app in the background to access camera and microphone resources on your phone, but you should be able to make the determination yourself, with a complete understanding of what is happening. The upcoming changes in Android P will help you take back your privacy.

An official release date for Android P has not been announced, although it is usually available as a preview for developers around the time of the Google I/O conference which is scheduled for May this year. Hopefully, we will see how well the proposed changes will work in the real world.

Pierluigi Paganini