If you’re reading this article, it’s likely that
you’re hoping for quick tips on what to do if you suspect there’s spyware or a
tracker on your phone. If that is the case, you’re likely to be disappointed;
there are no quick lists of things to identify or remove to make you safe
again. But that doesn’t mean there is nothing you can do. While it will
require a determined effort, the good news is that you can make your devices
more resilient against a wide variety of different security threats including
spyware.
Increasing complexity = no quick fix
If you’re wondering why there is no quick fix, a
brief look into the past can give the answer. As the popular maxim
goes: “History doesn’t repeat itself but it often rhymes.” In technology, as in
so many areas of life, we often see recurring patterns of threats. But there’s
always a twist, as the underlying technology evolves. Such is the case with
spyware and other threats on mobile phones.
Desktop computers have had malware for many
decades, and those threats changed over time. Early malware was both simple and
so rare as to be popularly considered an “urban legend”; the entire instruction
set for finding and removing all known malicious code used to fit on a floppy
disk, and this only needed to be updated for new threats on a quarterly basis.
Now, anti-malware products find and remove so many threats that counts cease to
have practical meaning, and updates for new threats must be delivered well-nigh
constantly. As a result, where we could once say, “look for A, B or C files to
see if you’re infected”, or “do X, Y and Z to clear your device”, now we can’t
realistically give such simplistic advice.
Likewise, threats targeting mobile phones have
grown in both quantity and complexity. Where we used to be able to give a short
list of things to look for to see if you’ve been affected by specific malware
programs, that’s no longer realistic. If you’re reading this because you think
someone might have installed spyware on your phone, it’s probably best to proceed
as if your suspicions are correct.
Mobile phones, aka “the computer in your
hand”
As we moved from the early days where threats were
few and new ones appeared infrequently, to the present situation of having a
practically uncountable number of threats, malware researchers tried to find
some way to help people figure out which threats are of greatest concern. One
such method was to include a rating for the “severity” of the threat, meaning
how much potential there was for harm to an affected user. In one threat-rating
model, spyware and backdoors were considered to have “infinite” damage
potential because there was almost no limit to how much harm attackers could
cause if they could quietly sit on your machine and passively watch your every
action or manipulate your computer as if they were sitting at your desk.
Now most of us carry powerful computers with us
wherever we go, and those computers are equipped with receivers that identify our
location at all times. As a result, someone who’s watching us on our phones has
even more capability to monitor our activities, as our computers are likely
within arm’s reach all day and night.
Time to get thorough
Rather than trying to scare you with my previous
description of the damage that could be done, I’m hoping historical context
will give you an idea of the sort of changes that will need to be made if you
believe you’re being tracked.
If you’ve ever had to go through the process of
replacing a stolen credit card, or of changing your legal name for marriage,
you’ll have a good sense of how much it can help to sit down and create an
exhaustive list before proceeding. In order to do that with a clear head, you
will need to get yourself out of harm’s way first.
·
Start with your phone
If you suspect your device is being tracked, you
must consider the affected device “untrusted” from here on out, as even
restoring it to factory settings may not completely clear a tracker. The
microphone or camera functionality of your phone may be in use by the tracker,
so be mindful of what is happening around your device. As unintuitive as this
may sound, you may not want to power your phone off, as this may compromise
data or evidence on your phone. Do turn off network connectivity immediately;
put the device in Airplane Mode, and make sure this has disabled Wi-Fi and
Bluetooth connectivity as well.
In order to preserve evidence or have an expert
check your device, you’ll need to act promptly and carefully, as there are
still ways malware could affect data stored on your device, even without access
to a network connection. Put your phone out of earshot, and leave it there
while you get to a safe place. When you are ready to forward your phone to an
expert, put it into a Faraday Bag before interacting with it again.
“Keep in mind that SMS text
messages are not encrypted”
While it certainly doesn’t hurt to ask for help
from local law enforcement, know that even major cities may not have the
expertise or the bandwidth to investigate compromised mobile devices. The
most important objective is to take steps to make sure you’re safe.
Ask for help, but do not wait for others to help you.
Once you are out of physical proximity of the
mobile device being tracked, you can begin to take a more thorough assessment
of your situation and start bolstering your defenses.
·
Check your other devices
While it is entirely possible that any tracking is
limited to one device, it’s a good idea to check any desktop, laptop, tablet,
or cellphones that you use. Keep potentially-compromised devices out of your
safe space so that they cannot report this location to the person tracking you.
If you’ve forwarded your mobile device to an expert for analysis, they may also
need you to provide access to these additional devices.
Once you determine that devices are safe, you
should bolster your overall security precautions. Make sure you have updated
security software including anti-malware and firewall functionality. Update
your software including your operating system, Internet browsers and plugins.
Change your passwords: choose ones that are strong, memorable and unique for each device and account. Do
not re-use passwords for different accounts or devices. Going forward, once
you have determined that your devices are clean, you may decide to encrypt data
stored on your devices and communications sent over the network, such as via
email or instant messaging. Keep in mind that SMS text messages are not
encrypted.
·
Check online accounts and services
Most of us use our phones to access a variety of
online resources; this may include online banking, social media, online review
sites, etc. Many sites will allow you to de-authorize devices: if that option
is available, remove the compromised devices.
Now is a good time to improve security for every
account you have accessed on your phone and any other affected devices. Delete accounts
you no longer use. Once again, change your passwords, and make sure your
choices are strong, memorable and unique. Wherever it’s available, enable two-factor authentication but do not send keys via SMS, or to
email accounts that are linked to devices that are being tracked, as this will
mean your attacker can use also use these keys to access your accounts. You
should also set up login notification, so that you will be alerted if
unauthorized devices try to get into your accounts.
·
Leave the backup
If you’re in the habit of taking regular backups,
you might be inclined to start pulling files from your online or offline backup
sources. As it can be hard to know at what point tracking began, it is safer to
assume that backups are compromised, especially if the backup was accessible to
a device you suspect has been tracked. If you want to recover your valid data
files while leaving suspicious files behind, you may need to employ an expert.
·
Get a “burner” phone
Until you can be fairly certain that your situation
is resolved, you may want to get a temporary, prepaid “burner” phone that is limited to emergency
contacts. Do not log onto online accounts or services from this device, and do
not contact anyone who might give the number to the person you suspect is
tracking you.
“You should also set up
login notification, so that you will be alerted if unauthorized devices try to
get into your accounts”
Any other steps you might need to take will depend
on who is tracking you: for example, if you live in the same house with the
person, you’ll need to get yourself to a safe location as soon as possible.
Once you’ve extricated yourself from immediate danger, there are a number of
other things you can and should do to protect yourself. If the person
tracking you is an acquaintance or someone entirely unknown to you, they may be
more interested in your assets, or in your absence from a location rather than
your presence.
When you’re ready to get a new phone, be sure to
secure it well. Set a password to lock your device, rather than a less-secure
numeric PIN or pattern-lock. Install a mobile security product, if you’re using
an Android device. You may want to set your device to automatically install
updates, so they’re applied promptly. You can also set your device to only allow
the installation of apps from reputable app stores, but your caution should not
end there: be judicious about checking that apps are well (and positively)
reviewed, and consider if the permissions it’s requesting seem reasonable for
the purpose of the software. And finally, be vigilant about clicking links in
email – it’s better to err on the side of typing a website directly into your
browser rather than clicking a link that may send you somewhere unexpected and
potentially dangerous.
Each situation is different, and your specific
needs will necessarily vary. You should consider consulting with a lawyer or a
social worker, who can help you make a thorough plan to keep yourself safe.
