A loophole on Android allows a malicious app to take control of a device’s camera and capture images and videos before uploading them to a server – all without your knowledge. A former Google engineer has managed to recreate the scenario and published the video of it in action, which can be viewed in the YouTube link above.
Essentially, the loophole within Android that allows malicious apps to take control of the camera is pretty simple. Google requires that all apps that opening the camera to show a preview on the screen, but did not have a minimum size requirement of the preview. Hence, malicious apps can just show the preview in just one pixel and you won’t even know it (a Full HD display has 1920 x 1080 pixels, which totals over two million pixels on the screen). On top of that, the video above also demonstrates that a malicious app will continue snapping away even when the phone is locked.
Malicious apps can take pictures and videos from your Android device’s camera, and you may not even know it.
The former Google engineer, Szymon Sidor, notes that until Google fixes it in future Android updates, users will have to be very careful on any apps that they install on their Android devices. With every app requiring users’ permission to access certain parts of the phone before it can be installed, it’s always a very good idea to see what access an app requires before installing them – the Bomoh app is one good example. In addition, if an app is using up unusually high amounts of processing power and battery, there may be something going on without your knowledge.
Finally, if you’re using custom ROMs from Chinese makers like Oppo and Xiaomi with its Color OS and MIUI, you can access the Permission Monitor and individually deny certain apps from accessing the camera and still allow the app to run, which is very useful in this case. CyanogenMod’s Privacy Guard also lets you manually allow or deny apps from accessing specific parts of the device.
More technical details can be viewed on Sidor’s blog here.
(Source: Szymon Sidor via Phone Arena)
