According to a study presented at a hacker conference this week by security firm Lookout, more than 80 such apps were found to be collecting phone numbers and other personal information, including the IMSI number that identifies a cellphone subscriber. The apps also transmitted sensitive data unencrypted to a server.
Google said it has suspended the application while it investigates further.
The wallpaper apps—all made by a developer named “jackeey,wallpaperr”—notified users that the app would have access to “phone state and identity.” But John Hering, Lookout’s CEO, said most users don’t pay enough attention to such notices.
The discovery highlights the growing threats to privacy posed by the explosion of wireless apps, as well as the different privacy models of wireless app store providers such as Google and Apple.
“I don’t think most consumers would realize their personal data was being uploaded to a server,” Mr. Hering said. He said apps that access similar data also can be found on Apple’s App Store.
Google’s Android Market has a policy that users be notified about data an app will access before installing the app. “We consistently advise users to only install apps they trust,” a Google spokesman said.
Apple’s App Store doesn’t notify users unless location data is involved. But “Apple is a curated model,” Mr. Hering said. “They are vetting the apps for users.” Apple has said it checks developers’ identities and takes security seriously.
Mr. Hering said he doesn’t know what the developer is doing with the information. Lookout traced the data to a server in San Jose, Calif., that was registered to an owner based in the Shenzen province of China.
The apps were seemingly innocuous, allowing a user to post pictures of Star Wars figures and Hello Kitty icons as the background of their cellphones.
Since Lookout exposed the applications, the developer has changed his name. The publisher of the wallpaper apps is now listed as “callmejack” and “IceskYsl@1sters!”
UPDATE: Apple spokeswoman Trudy Muller said the company, with its new operating system, has gone to great lengths to protect users’ privacy. Any app that collects private information is required to ask a user’s permission first, she said
http://blogs.wsj.com/digits/2010/07/29/ ... JBlog&mod=
