Forget Aadhaar, your phone can reveal all your private details to hackers

From your fingerprint to most private images and financial info - all your privacy is under constant threat

What do you do when you buy a smartphone? Install Facebook and WhatsApp after the mandatory settings are put in place. While the next set of downloads involving third-party apps follows soon after, the catch is we rarely go through their permission policies.

A closer look at the permission policy of one of the most commonly used applications such as Facebook, for instance, reveals that it asks for access to all of the subscriber’s contacts and information stored in the handset. Moreover, it also seeks to have access to the device camera and to make calls, without informing the user. While Facebook is a proprietary app, the rule remains the same for many third-party applications, whose origin and ownership remain unknown to most of us.

At a time when data leaks from the Unique Identification Authority of India (UIDAI) — the body that maintains the Aadhaar data of over a billion Indians — are raising disturbing questions over the security of one’s personal information, breach of privacy can come from one’s handheld device. From biometric details such as fingerprints and retina scans to financial information such as credit card numbers and passwords — all may be up for sale if one’s handset is hacked.

And while the possibility of a mobile hack was of little concern a few years ago, that is no longer the case now. The falling price of the International Mobile Subscriber Identity (IMSI)-catcher and a flurry of other malwares have now changed the tide against common users. IMSI, for example, is today widely used (by hackers) to identify a user of a mobile network, making analysts and experts jittery.

While users of all types of mobile handsets can be targets of hacks, users of open operating systems such as Android, which comprise over 80 per cent of all mobile users globally and over 90 per cent in India, are most vulnerable. For example, the data used to identify iPhone users for touch ID and face ID is converted into mathematical representations that are encrypted and protected by the secure enclave feature on the phone, where it cannot be accessed by iOS (Apple operating system) or other apps. It is also not stored on Apple servers or backed up to iCloud, making it virtually impossible to leak private data. But there is no such security feature available to Android users, making them prone to data attacks.

According to Gurpal Singh, senior market analyst, IDC, risks of data theft on mobile phones are growing exponentially. “Any information stored in the mobile phone can be accessed from a remote location. Once a malware or advanced virus gets into the system, it can copy and send all information to the hackers. It can also enable the camera, forward text messages, redirect calls and send any files from the device, without the user even knowing about its activity,” he said.

Such incidents are not rare. According to anti-virus major Norton’s recent mobile survey, over a third or 34 per cent of mobile phone users in India have faced malware or virus attacks recently, followed by threats involving fraudulent access or misuse of credit card or bank account details (21 per cent). The share of people facing hacking and leakage of personal information is no less. Nearly one in five (19 per cent) mobile users’ privacy has been breached in recent months, the survey says.

As half the users (50 per cent) grant permission to send promotional texts and/or emails to application providers, the threat levels are only rising. The survey reveals that 47 per cent of users have granted access to their contacts in exchange for free apps. And close to 40 per cent have granted permission to access their camera, bookmarks, and browser history.

Experts say while the damage from leakage of personal data like images, documents, and financial details may still be compensated, once biometric data is compromised, the loss is irreparable. As an increasing number of smartphones now comes with added features such as fingerprint scanners and iris scanners, such biometric data stored in devices may land up in the hands of hackers. However, once lost, these cannot be changed to secure one’s identity unlike passwords and account details.

“Digital security is still an afterthought for many. Getting a new mobile phone scratched is more worrisome than the risk of having it infected by a virus. While desktops and laptops do get the attention they need for their security, mobile phones still have a long way to go in this aspect. It’s time individuals and businesses realised that viruses, malware, and Internet threats do not only prey on computers,” Sanjay Katkar, joint managing director and chief technology officer, Quick Heal Technologies, says.

Mobile hackers are turning their attention towards enterprises too. According to experts, with the rising acceptance of BYOD (Bring your own device), enterprises are also at risk of mobile threats, with employees accessing official data on their mobile phones. Giving such a device unrestricted access to personal and official information and leaving it exposed to infected websites, fake or malicious apps can only spell disaster.