DCentral1 - John McAfee's app that exposes spyware apps on your device.

Desmond

Destroy Erase Improve
Staff member
Admin
It is still surprising that people blindly download apps without checking the permissions that the apps require, which may not even be necessary for the apps to run. Regarding this practice, John McAfee, founder of McAfee Inc., wrote the following in his blog:

Imagine the following scenario:

You walk into a store to buy a microwave. After choosing one, you proceed to the checkout counter, where the employee tells you:
​”We will sell you this microwave under the following conditions: First, you must allow us* to read every email that you write or read on your mobile phone/device from now on. This includes any private emails that you may send or receive from lovers, friends, business and personal acquaintances, and anyone else who communicates with you. Second, you must allow us* to read any SMS messages that you send or receive. Third, you must allow us* to watch and listen to everything you do or say from now on, via the microphone and camera on your mobile device. This includes private moments – intimate moments with your spouse or lover, moments when you’re showering, preparing for work or for play – moments when you would expect a level of privacy. Fourth, you must allow us* to read your contacts, send messages to them on your behalf (without your knowledge or consent), then read any replies to those messages, and delete them before you see them if we so choose. Fifth, you must allow us* to make phone calls on your mobile telephone without your knowledge, and you agree to pay any charges incurred for these calls. Sixth, you must allow us* to modify you contacts list, or any other element of your mobile phone/device that we may choose. This includes, but is not limited to: turning off the ringer/vibration function, powering up your device after you have turned it off, or disconnecting you from your WiFi, and reconnecting you to a WiFi of our choosing. Seventh, you must allow us* to listen to and record every phone call to or from your mobile device, and distribute it to anyone we choose.”

*’us’ includes Our Corporation, and any/all employees, sub-contractors, and over-seas workers we may ever hire.

“So now, just press the “I Accept” button on the checkout register to agree to these terms, and we can sell you the microwave”

I suspect very few people would agree to these terms in order to buy a microwave oven. Yet nearly everyone agrees to terms just like these when they download the average mobile application. For example: it was recently discovered that all of the ten most popular ‘flashlight’ apps for mobile phones includes such agreements and equivalent malware. This report on Fox News confirms this statistic:

A Cybersecurity Threat That Could Be Lurking On Your Phone | Special Report | Bret Baier | Fox News Channel

And it’s not just flashlight apps. Nearly every free app that you download requests permissions that are absolutely not necessary for the functions performed by the app. Over half the free Bible apps (apps that read Bible passages aloud) for example, request permission to access your contacts, read and write SMS messages, read your emails, turn on your camera and microphone, and make phone calls. If you are running one of these apps, then you have agreed to their terms. You can’t run any app without agreeing to their terms.

If you have any doubts, then I recommend you download DCentral1 (A Future Tense Central product) from Google Play, and let it scan your Android phone or device. It will tell you exactly what every app you have downloaded has asked permission to do – and you will be shocked. DCentral1 is my own app, and it asks for no permissions, as you will verify prior to installation.

*play.google.com/store/apps/details?id=com.dcentral1.android&hl=en

The question you have to ask yourself is: Why do you gladly accept outrageous terms and invasions of your privacy in order to get an app you want? You would never dream of accepting these terms when buying something like a lawn mower, microwave, car or even a house. I’m baffled.

Some of you are aware of this gross intrusion, while many others doubt that a mobile app could have the capabilities described above. It does sound like science fiction, or possibly rampant paranoia – yet it is real. Anyone can download one of the thousands of spyware applications, many for free, and can remotely plant the software on anyone’s device — anyone — a spouse, a boss, a neighbor, a teacher, a parent, the local sherrif — anyone. The world’s largest Spyware manufacturer – Finfisher – was recently hacked, and thousands of it’s internal documents showed up on Wikileaks, including much of their source code for the spyware – meaning anyone can have access to it. Here is the story about the hack:

Top gov't spyware company hacked; Gamma's FinFisher leaked | ZDNet

The following links to FinFishers sales videos, showing the astonishing capabilities of spyware, should be a real eye opener. Keep in mind this is only one of thousands of companies who manufacture spyware for mobile devices.

Top gov't spyware company hacked; Gamma's FinFisher leaked | ZDNet

*wikileaks.org/spyfiles/files/0/303_GAMMA-201110-FinSpy_Mobile.mp4

*wikileaks.org/spyfiles/docs/gamma/301_remote-monitoring-and-infection-solutions-finspy.html

*wikileaks.org/spyfiles/docs/gamma/308_remote-monitoring-and-infection-solutions-finfly-web.html

*wikileaks.org/spyfiles/docs/gamma/309_remote-monitoring-and-infection-solutions-finfly-isp.html

*wikileaks.org/spyfiles/docs/gamma/306_tactical-it-intrusion-portfolio-finusb-suite.html

*wikileaks.org/spyfiles/docs/gamma/300_tactical-it-intrusion-portfolio-finintrusion-kit.html

*wikileaks.org/spyfiles/docs/gamma/302_it-intrusion-training-program-fintraining.html

#LegalizeFreedom

John McAfee

2014

Source: *www.whoismcafee.com/three-guys-walk-into-a-microwave/

TL;DR: He has released an app called DCentral1 which scans your phone and lists apps according to score that determines the apps intrusiveness and risk. A higher score means more intrusive.

Check it out and tell what do you guys think?

The app can be found here: *play.google.com/store/apps/details?id=com.dcentral1.android&hl=en
 

Anorion

Sith Lord
Staff member
Admin
yep... was having the same discussion with a friend
Android has no granular control over app permissions, you can either allow it access to your contacts, location, photos etc, or not. If not, the app does not install. There is no option to pick and choose what kind of access you want to give to the app. It's pretty easy to say put out a keyboard app out there that is also a keylogger.
 
OP
Desmond

Desmond

Destroy Erase Improve
Staff member
Admin
Yeah. I have been thinking something on the same lines. But I think it is better to have a black and white environment where you prevent potential malware apps from installing at all.

Otherwise, the an environment should be made where in the user can be notified when an app tries to access private info or system services. Somewhat similar to Superuser for rooted Android devices but for normal environments.
 

dashing.sujay

Moving
Staff member
Xiaomi is having a permission manager which literally allows to control each and every permission an app seeks for (even GAPPS). It comes with stock and is very very useful for people who want to take full control.
 

Anorion

Sith Lord
Staff member
Admin
because it's pretty insecure, your personal device is no different than a public cyber cafe

for the Xiaomi permission manager and CM privacy guard
1) can you allow access to say contacts but not location when the app demands both?
2) what happens at time of install, do you have to give a yes to all and then revoke the permissions later? or can you specify the permissions at the time of install itself?
 

amjath

Human Spambot
because it's pretty insecure, your personal device is no different than a public cyber cafe

for the Xiaomi permission manager and CM privacy guard
1) can you allow access to say contacts but not location when the app demands both?
2) what happens at time of install, do you have to give a yes to all and then revoke the permissions later? or can you specify the permissions at the time of install itself?
Cm privacy guard:
1. Yes
2. [strike]yes[/strike] First of all you need to turn on privacy guard. Answer is No, but for example if u install whatsapp permission will not ask. But if you open whatsapp it, you will zero contacts since privacy is guarded.
 
Last edited:

amjath

Human Spambot
:+1: CM's privacy guard is good
Its not half backed, perfectly written code. That's what I like about cm.
^Oh nice. Yep that makes sense, should be in all phones
Multi window from Samsung gonna embed in stock android in next iteration so same might be added. I highly doubt that Google offered acquisition for this purpose, implement this for business users or whiners :p For whiners or general users they can't get privacy guard correctly :p
 
Top Bottom