Even as Google and Apple make headlines with new security features for Android and iPhone, the mobile threat landscape has never been worse. Your phone is under attack from malicious texts and emails, malware-laced apps, even over-the-air threats. Some of this is hard to detect. But one message on screen is a glaring red flag.
It’s fairly straightforward to ensure your phone — the digital key to your life — is better protected. Do not click links or download unexpected attachments; do not install apps from outside official stores; and always run an updated version of the phone’s OS.
It should be that simple, but it’s not. There are upwards of a billion smartphones that are running outdated operating systems that no longer receive security updates. Sideloading apps from emails, messages and third-party stores remains popular. And hardly a week goes by without news of new text or email attacks claiming victims.
But there is one safeguard that really is simple. It stops attackers hijacking devices and taking control of your cameras and microphone. It prevents current threats such as LumaSpy and PlayPraetor from carrying out their worst. And it makes it immeasurably more difficult for bad actors to run riot on your device.
We’re talking accessibility services, permissions which grant wholesale access to a phone. “Your app must use platform-level accessibility services only for the purpose of helping users with disabilities interact with your app,” Google says. But alas this is the golden ticket for malware developers. All they need to do is trick you into saying yes.
The “power” of these accessibility services is such that “very few official apps will mess with it for fear of attracting the wrath of Google,” Bitdefender says. But unfortunately, “malicious apps don’t have the same qualms,” and “many types of malware will try to gain access to this permission as a way to take over control and monitor devices.”
Google has locked down accessibility services. But “the security enhancements aimed at limiting abuse of Android’s accessibility services have been systematically circumvented by sophisticated malware loaders. This has enabled a new generation of banking trojans, keyloggers, and remote access tools to persistently target users.”
The screenshots above (courtesy of Zimperium) illustrate what you need to look for. Any app you have installed that asks for “full control” is a serious risk. Unless you have downloaded an app that requires control of a device given your own personal needs, it’s dangerous to grant these permissions. You should delete the app.