Spying Android Apps Detected by TaintDroid

Motorola's new Droid smart phone sold through Verizon. George Frey/Getty Images

A new Android application, TaintDroid, can detect if apps are sending a user’s phone number or other data to outside sources. TaintDroid was made by researchers at Intel Labs, Penn State, and Duke University.

A video demo of TaintDroid, available on the group’s website at www.appanalysis.org, shows a user running the application on a Nexus One phone. A few seconds after opening a wallpaper app, they get an alert showing that the app just sent the user’s personal data to an outside source.

The particular app sent the user’s phone number, IMEI number that identifies the phone’s hardware, and the SIM card identifier for the phone.

“Today’s smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data,” says a report from TaintDroid’s creators.

“We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data,” the report says.

The application is able to monitor the activity of a phone’s apps real-time by using Android’s virtualized execution environment.

TaintDroid is not able to be run as a stand-alone app, so users need to install it through a device’s firmware. The group adds on their website that “In the coming days we will open-source our code through a publicly-accessible repository.”