{"id":15858,"date":"2019-07-22T10:27:44","date_gmt":"2019-07-22T18:27:44","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/07\/22\/news-9603\/"},"modified":"2019-07-22T10:27:44","modified_gmt":"2019-07-22T18:27:44","slug":"news-9603","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/07\/22\/news-9603\/","title":{"rendered":"Parental monitoring apps: How do they differ from stalkerware?"},"content":{"rendered":"

Credit to Author: David Ruiz| Date: Mon, 22 Jul 2019 15:00:00 +0000<\/strong><\/p>\n

In late June, Malwarebytes revived its long-running campaign<\/a> against a vicious type of malware in use today. This malware peers into text messages. It pinpoints victims\u2019 movements across locations. It reveals browsing and search history. Often hidden from users, it removes their expectation of, right to, and real-world privacy. <\/p>\n

But after we recommitted our staunch opposition to this type of malware\u2014called stalkerware<\/a>\u2014we received questions about something else: Parental monitoring apps. <\/p>\n

The capabilities between the two often overlap. <\/p>\n

TeenSafe, which retooled its product to focus on safe driving, previously let parents read their children\u2019s text messages. Qustodio, recommended by the Wirecutter for parents who want to limit their children\u2019s device usage<\/a>, lets parents track their kids\u2019 locations. Kidguard, clearly named and advertised as a child safety app, lets parents view their children\u2019s browsing and search history. <\/p>\n

Quickly, the line becomes blurred. What are the differences between stalkerware apps and parental monitoring apps? What is an \u201cacceptable\u201d or \u201csafe\u201d parental monitoring app? And how can a parent know whether they\u2019re downloading a \u201clegitimate\u201d parental monitoring app instead of a stalkerware app merely disguised as a tool for parents? <\/p>\n

Malwarebytes Labs is not here to tell people how to parent their children. We are here to investigate, report, and inform. <\/p>\n

Knowing what we do about parental monitoring apps\u2014their capabilities, their cybersecurity vulnerabilities, and their privacy implications\u2014our safest recommendation is to avoid these apps. <\/p>\n

However, we understand the digital challenges facing parents today. Cyber bullying remains a constant concern<\/a>, violent images and videos profligate online, and extremist content lingers across multiple platforms. <\/p>\n

Diana Freed, a PhD student at the Intimate Partner Violence tech research lab<\/a> led by Cornell Tech faculty, said she understands the appeal of these tools for parents. They advertise safety, she said. <\/p>\n

\u201cI believe that when parents are putting these apps on someone\u2019s phone, they\u2019re trying to do it to make their child safer,\u201d Freed said. \u201cThey\u2019re not saying \u2018I don\u2019t want my child to not have privacy.\u2019 They think they\u2019re doing the best they can to make this a safer place for their child.\u201d<\/p>\n

However, Freed explained, there is a lot to these apps that parents should know. <\/p>\n

\u201cLet\u2019s assume that everyone is a good actor and wants to do the right thing,\u201d Freed said. \u201cBut it is a matter of, is it clear to that parent what these apps are doing?\u201d <\/p>\n

What\u2019s the difference? <\/h3>\n

Multiple privacy advocates and cybersecurity researchers said that, when comparing the technical capabilities of parental monitoring apps to those of stalkerware apps, the light that shines between the two is dim, if not entirely absent. <\/p>\n

\u201cIs there a line between legitimate monitoring apps and stalkerware apps?\u201d said Cynthia Khoo, author of the CitizenLab report on stalkerware \u201cPredator in Your Pocket<\/a>.\u201d <\/p>\n

She answered her own question: <\/p>\n

\n

\u201cOn a technological level, no. There is no differentiation.\u201d <\/p>\n<\/blockquote>\n

Khoo explained that, when working with her co-authors on the Predator in Your Pocket paper, the team initially struggled with how to address monitoring applications that advertise themselves in benign, non-predatory ways, yet provide users with reams of sensitive information. It is the famous \u201cdual-use\u201d problem with stalkerware: some apps, though not advertised or designed for invasive monitoring, still provide the same capabilities. <\/p>\n

That struggle disappeared though, Khoo said, when the team realized that apps could be evaluated by their capabilities, and whether those capabilities could violate the laws of Canada, where CitizenLab is located. <\/p>\n

\u201cWe realized that if an app is not just providing location monitoring, if it\u2019s collecting information from social media accounts, the private contents of someone\u2019s phone\u2014in Canadian law, that could be seen as unlawful interception of someone\u2019s phone, unauthorized access to someone\u2019s computer,\u201d Khoo said. \u201cRegardless of branding or marketing, that\u2019s a criminal offense.\u201d <\/p>\n

Emory Roane, policy counsel at Privacy Rights Clearinghouse, said that, not only are the technical capabilities of stalkerware apps and parental monitoring apps highly similar, the capabilities themselves can be found within the type of hacking tools used by nation states. <\/p>\n

\u201cIf you look at the capabilities: What results can be gathered from devices implanted with stalkerware versus devices hacked by nation states? It\u2019s the same,\u201d Roane said. \u201cTurning on and off the device remotely, key loggers, tracking via GPS, all of this stuff.\u201d <\/p>\n

Roane continued: \u201cWe have to be very careful about the use of these by parents.\u201d <\/p>\n

Both Roane and Khoo also warned about the lack of consent allowed by many of these apps. Some stalkerware apps, like mSpy, FlexiSPY, and Hoverwatch, can operate entirely hidden from view, absent from a device\u2019s app drawer. <\/p>\n

Some parental monitoring apps offer the exact same feature. <\/p>\n

Particularly concerning, we found that the app Kidguard actually reviewed the stalkerware app mSpy on its own website. In the list of pros and cons for mSpy, Kidguard listed the following as a positive:<\/p>\n

\u201cOperates 100% invisibly, cannot be detected.\u201d<\/p>\n

This invisible capability is a clear warning sign about any monitoring app, Khoo said. <\/p>\n

\u201cThere is no legitimate reason or need to hide surveillance if it is truly for a genuine, good faith, legal, legitimate purpose,\u201d Khoo said. \u201cIf you have the person\u2019s consent, you don\u2019t need to hide. If you don\u2019t have consent, this shouldn\u2019t be used in the first place.\u201d<\/p>\n

We agree. <\/p>\n

Any monitoring app designed to hide itself from the end-user is designed against consent.<\/p>\n

The cybersecurity risks <\/h3>\n

The cybersecurity reputations of several parental monitoring apps are questionable, as the companies behind them have left data\u2014including photos and videos of children\u2014vulnerable to threat actors and hackers. <\/p>\n

In 2017, Cisco researchers disclosed multiple vulnerabilities for the network device \u201cCircle with Disney,\u201d<\/a> a tool meant to monitor a child\u2019s Internet usage. The researchers found that Circle with Disney had vulnerabilities that could have let a hacker \u201cgain various levels of access and privilege, including the ability to alter network traffic, execute arbitrary remote code, inject commands, install unsigned firmware, accept a different certificate than intended, bypass authentication, escalate privileges, reboot the device, install a persistent backdoor, overwrite files, or even completely brick the device.\u201d<\/p>\n

In 2018, a UK-based cybersecurity researcher found two unsecured cloud servers operated by TeenSafe<\/a>. Located on the servers were tens of thousands of accounts details\u2014including parents\u2019 email addresses and children\u2019s Apple ID email addresses, along with their device names, unique identifiers, and plaintext passwords. <\/p>\n

ZDNet, which covered the vulnerability, wrote: <\/p>\n

\n

\u201cBecause the app requires that two-factor authentication is turned off<\/a>, a malicious actor viewing this data only needs to use the credentials to break into the child’s account to access their personal content data.\u201d<\/p>\n<\/blockquote>\n

Also in 2018, the parental monitoring company Family Orbit\u2014which offers an app on iOS and Android\u2014left open cloud storage servers that contained an eye-popping 281 gigabytes of sensitive data<\/a>. The vulnerable servers, identified by an online hacker, contained photographs and videos of children. <\/p>\n

These are just the cybersecurity flaws. This is nothing to mention the labyrinthine network of related third parties that could work with parental monitoring apps, receiving collected data and storing it across other, potentially unsecure servers littered across the web. <\/p>\n

Steadily, the American public has begun to understand and push back on the many ways in which their data is shared with numerous third parties, often without their express, individualized consent. If it isn\u2019t okay for adults, is it okay for children? <\/p>\n

The privacy risks<\/h3>\n

Parental monitoring apps can give parents a near-omniscient, unfiltered view into their children\u2019s lives, granting them access to text messages, shared photos, web browsing activity, locations visited, and call logs. Without getting consent from a child, these surveillance capabilities represent serious invasions of privacy. <\/p>\n

Privacy Rights Clearinghouse\u2019s Roane compared the clandestine use of these apps to a more familiar analogue:<\/p>\n

\u201cWould you support breaking into your child\u2019s diary if this was the ’80s?\u201d Roane said. \u201cThis is extremely sensitive information.\u201d <\/p>\n

Multiple studies have suggested that the relationship between parents and children can be significantly altered depending on the types of surveillance pushed onto them, with the age of a child playing a significant role. As a child grows older\u2014and as their need for privacy ties closely into their autonomy\u2014digital monitoring can potentially hinder their trust in their parents, their self-expression, and their mental health. <\/p>\n

A few years ago, UNICEF published a discussion paper<\/a> that warned of this very problem:<\/p>\n

\u201cThe tension between parental controls and children\u2019s right to privacy can best be viewed through the lens of children\u2019s evolving capacities. While parental controls may be appropriate for young children who are less able to direct and moderate their behaviour online, such controls are more difficult to justify for adolescents wishing to explore issues like sexuality, politics, and religion.\u201d<\/p>\n

The paper also warned that strict parental controls could impair a child\u2019s ability to \u201cseek outside help or advice with problems at home.\u201d<\/p>\n

According to the science magazine Nautilus, a one-year study of junior high students in the Netherlands<\/a> showed that students who were snooped on by their parents reported \u201cmore secretive behaviors, and their parents reported knowing less about the child\u2019s activities, friends, and whereabouts, compared to other parents.\u201d <\/p>\n

Laurence Steinberg, a professor of psychology at Temple University, told Nautilus that when parents invade their children\u2019s privacy, those children could be more at risk to suffer from depression, anxiety, and withdrawal. She told the outlet: <\/p>\n

\u201cThere\u2019s a lot of research indicating that kids who grow up with overly intrusive parents are more susceptible to those mental health problems, partly because they undermine the child\u2019s confidence in their abilities to function independently.\u201d<\/p>\n

Further, in the 2012 report, \u201cSurveillance Technologies and Children<\/a>,\u201d the Office of the Privacy Commissioner of Canada suggested that parents who rely on surveillance to keep their children safe risk stunting the maturity of those children. <\/p>\n

Tonya Rooney, a researcher in child development and relationships at the Australian Catholic University, said in the report:  <\/p>\n

\u201cWe need to question whether the technologies may be depriving children of the opportunity to develop confidence and competence in skills that would in turn leave them in a stronger position to assess and manage risks across a broad range of life experiences.\u201d  <\/p>\n

Unfortunately, this field of study is relatively new. As the children subject to parental monitoring apps reach adulthood, more can be measured, including whether those children will accept other forms of surveillance\u2014like from domestic partners and governments. <\/p>\n

If you\u2019re looking for a pithy takeaway, maybe read Gizmodo\u2019s article about a University of Central Florida study of teen monitoring apps: \u201cTeen Monitoring Apps Don’t Work and Just Make Teens Hate Their Parents, Study Finds<\/a>.\u201d<\/p>\n

Tough, necessary conversations<\/strong><\/h3>\n

We understand that telling readers about the never-ending downsides of parental monitoring apps fails to address the likely reality that many parents have engaged in some type of digital monitoring in a safe, healthy, and openly-communicated way. <\/p>\n

For those who have found safe passage, well done. For those who have not, the researchers we spoke to all agreed on one priority: If you absolutely insist on using one of these apps, you should discuss it with your children. <\/p>\n

\u201cYou can openly say [to a child] \u2018I am going to start looking at your location because we\u2019re concerned and this is how we\u2019re going to do it,’\u201d said Freed of the IPV tech lab at Cornell. \u201cIn terms of the child\u2019s privacy, have a conversation on the concerns and why you\u2019re doing it, what the app you\u2019re putting on their phone will do, what information you\u2019ll know.\u201d <\/p>\n

Freed continued: <\/p>\n

\n

\u201cWork through it together.\u201d <\/p>\n<\/blockquote>\n

Freed also suggested that parents could introduce only one type of digital monitoring at a time. For each additional capability\u2014location tracking, social media monitoring, browser activity monitoring\u2014Freed said parents should have a new conversation. <\/p>\n

Parents that are curious about a parental monitoring app\u2019s capabilities\u2014including whether that app could violate privacy\u2014should read the description available online through the App Store or the Google Play Store, said Sam Havron, another researcher and PhD student at the IPV tech lab. <\/p>\n

\u201cThe best thing, or the closest thing, is to look at the developers\u2019 descriptions on the marketplaces, look at the permission levels,\u201d Havron said. He said parents could also download the app and try it out on a separate device before utilizing it on a child\u2019s device. <\/p>\n

Ellen Zavian, the parent of a 13-year-old boy and a member of the Tech and Safety Subcommittee for the Montgomery County Council of Parent-Teacher Associations in Maryland, suggested that parents look at the issue differently: Don\u2019t focus so much on device software, focus on the device. <\/p>\n

Instead of installing a screen-time-limiting app on a child\u2019s device, or limiting what they see, or what apps they can use, remove the device entirely from the child\u2019s room and don\u2019t let them use it at night when they go to bed, Zavian said. Or maybe don\u2019t let them own a device at all, which Zavian is pledging to do until her son starts eighth grade\u2014a popular movement with parents called Wait Until 8th<\/a>. <\/p>\n

She also suggested only giving a child a Wi-Fi enabled device with no data plan, and then unplugging the home router to stop any Internet activity. Or parents could even prevent a child\u2019s device from connecting to the home Internet, a setup that can be configured on most modern routers. <\/p>\n

Zavian pressed on her point, making a comparison to another stressful moment in parenting\u2014letting teenagers drive. She said there\u2019s a difference between monitoring a teenager\u2019s driving through apps and monitoring the teenager\u2019s access to the car itself. <\/p>\n

\u201cWhen my friends were monitoring their kids with where they were driving to, my kids just wouldn\u2019t have keys to the car,\u201d Zavian said. \u201cWhy do you want to engage in that fight\u2014you\u2019ve got enough fights when they\u2019re teenagers\u2014where you say \u2018I saw you went here,\u2019 or \u2018I saw you were speeding here.\u2019\u201d <\/p>\n

Zavian suggested that parents remember there are always alternatives to using a parental monitoring app. In fact, those alternatives have existed for far longer, and she learned about them herself when learning to drive. <\/p>\n

\u201cJust like we did\u2014you get into a car accident, you\u2019re off the insurance,\u201d Zavian said. <\/p>\n

The post Parental monitoring apps: How do they differ from stalkerware?<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: David Ruiz| Date: Mon, 22 Jul 2019 15:00:00 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
What are the differences between stalkerware apps and parental monitoring apps? What is an \u201cacceptable\u201d or \u201csafe\u201d parental monitoring app? And how can a parent know whether they\u2019re downloading a \u201clegitimate\u201d parental monitoring app or instead a stalkerware app merely disguised as a tool for parents? <\/p>\n

Categories: <\/p>\n