Researchers Found Smartphone Apps Secretly Taking and Sharing Screenshots

A recent study conducted by researchers at Northeastern University in Boston, Massachusetts have some enlightening and disturbing findings: smartphone apps are not recording audio but are secretly collecting screenshots.

Computer science researchers Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes have been observing the behavior of thousands of mobile apps. But the ultimate goal is to find out whether or not these programs are really collecting audio files and recording people’s conversations without them knowing.

Surprisingly, the researchers did not find definitive results that would affirm this theory. However, they learned that several mobile apps are randomly taking screenshots. Even worse, the researchers observed in many cases that the covertly captured screenshots were also distributed to third-party servers.

In the course of the experiment, the researchers observed a total of 17,260 apps that are considered popular among Android users and are available in the Google Play Store and other digital distribution platforms. In a way, collecting data recorded from a smartphone screen is likely an easier task rather than secretly activating the microphone and start recording. As the paper also mentioned, “Unlike the camera and audio APIs, the APIs for taking screenshots and recording video of the screen are not protected by any permission.”

This loophole may have allowed malpractices among app developers. For example, the study found that a delivery service app called GoPuff automatically records a smartphone screen when the user opens the app. Collected data were reportedly being sent to the mobile analytics firm AppSee.

The researchers also found several cases where apps are collecting media files from the devices without the users knowing. Some photo-editing apps have been uploading media files from the devices and onto their remote servers “without explicitly notifying users.”

This pattern was reportedly observed in several apps, including Photo Cartoon Camera - PaintLab. The app does not need an internet connection to initiate its photo-editing functions, which made the media file uploads to their domain even more “unexpected.” Researchers added, “Further, uploading photos taken from within the app before users decide to keep them exposes those users to further privacy risks from unintentional photo sharing.”