The stalkerware: 2021 in Review - App Ranking Solution

Stalkerware—that’s, commercially-available apps that may be covertly put in on one other particular person’s system for the aim of monitoring their exercise with out their data or consent—is nothing new, however 2021 has underscored simply how prevalent and harmful these apps proceed to be and the way vital it’s for corporations and authorities to take motion to rein them in.

Table of Contents

2021 noticed the 2-year anniversary of the Coalition In opposition to Stalkerware, of which EFF is a founding member. In 2021, the Coalition continued to supply coaching, revealed instruments and analysis, and labored immediately with survivors of home abuse and intimate associate violence and the organizations that help them. EFF additionally took half in dozens of awareness-raising occasions, together with EFF at House’s Combating Stalkerware version in Might and a chat on the state of stalkerware within the Apple ecosystem at 2021’s Goal by the Sea.

A 2021 Norton Lifelock survey of 10,000 adults throughout ten international locations discovered that nearly 1 in 10 respondents who had been in a romantic relationship admitted to utilizing a stalkerware app to observe a present or former associate’s system exercise. The identical report signifies that the issue could also be worsening. Norton Labs discovered that “the variety of units reporting stalkerware samples each day elevated markedly by 63% between September 2020 and Might 2021” with the 30-day shifting common blowing up from 48,000 to 78,000 detections. Norton Labs reported that 250,000 units have been compromised with greater than 6,000 stalkerware variants in Might 2021 alone, with many units contaminated with a number of stalkerware apps. In the meantime, antivirus vendor Kaspersky reported that within the first ten months of 2021, virtually 28,000 of its cellular customers have been affected by the specter of stalkerware. The vary in numbers between these two antivirus corporations means that we could also be evaluating apples to oranges, however even Kaspersky’s considerably decrease variety of detections signifies that stalkerware stays a big risk in 2021.

2021 was additionally the 12 months that Apple selected to enter the bodily tracker market, debuting the AirTag. Apple used the entire current iPhones to create a strong community that gave it a significant benefit over Tile and Chipolo in location monitoring, however it had additionally created a highly effective instrument for stalkers with inadequate mitigations. Except for an easily-muffled beep after 36 hours (shortened after our criticism to 24), there was no means for customers outdoors of the Apple ecosystem to know that they have been being tracked. In December, Apple launched an Android app referred to as Tracker Detect to permit Android customers to scan for Air Tags, however there may be nonetheless an extended technique to go earlier than iPhone customers have the identical notification skills as Android customers.

2021 additionally continued the pattern of stalkerware information leaks. In February, developer Until Kottman found that stalkerware app KidsGuard, which markets itself each as a stealthy means for folks to observe their kids and in addition as a great tool to “catch a dishonest partner,” was leaking victims’ information by exfiltrating it to an unprotected Alibaba cloud bucket. And in September, safety researcher Jo Coscia discovered that stalkerware app pcTattleTale left screenshots of victims’ telephones completely uncovered and visual to anybody who knew the URL to go to. Coscia additionally confirmed that pcTattleTale didn’t delete the screenshots made by customers of the 30-day trial of the stalkerware whose 30 days had expired, despite the fact that the corporate explicitly claimed in any other case.

The FTC additionally cracked down on a stalkerware app maker, issuing its very first outright ban on Help King, maker of the Spyfone stalkerware app, and its CEO Scott Zuckerman. The FTC took motion towards Spyfone, which it says “harvested and shared information on folks’s bodily actions, telephone use and on-line actions by a hidden system hack,” not simply because the app facilitated unlawful surveillance, however as a result of like KidsGuard and pcTattleTale, the product leaked the info collected from victims. The FTC described Spyfone’s safety as “slipshod,” acknowledged its intention to “be aggressive about looking for surveillance bans when corporations and their executives egregiously invade our privateness,” and cited our advocacy as inspiration. We hope this implies we are going to see extra bans in 2022.

In 2020, Google banned stalkerware advertisements in its Play retailer. The outcome has been the occasional purge of stalkerware advertisements, together with one in October 2021. Whereas many advertisements have been purged, TechCrunch journalist Zack Whittacker discovered that “a number of stalkerware apps used quite a lot of strategies to efficiently evade Google’s ban on promoting apps for associate surveillance and have been in a position to get Google advertisements accepted.” The whack-a-mole continues.

Together with your help, we will transfer past whack-a-mole and proceed to struggle stalkerware by coverage, training, and detection in 2022.