Android phones can be tracked without using
their GPS or wi-fi data by studying their power
use over time, a study has found.
A smartphone uses more power the further away
it is from a cellular base and the more obstacles
are in its way as it reaches for a signal.
Additional power use by other activities could be
factored out with algorithms, the researchers
found.
They created an app designed to collect data
about power consumption.
"The malicious app has neither permission to
access the GPS nor other location providers (eg
cellular or wi-fi network)," the team - Yan
Michalevsky, Dan Boneh and Aaron Schulman,
from the computer science department at
Stanford University, along with Gabi Nakibly, from
Rafael Ltd - wrote in their paper .
"We only assume permission for network
connectivity and access to the power data.
"These are very common permissions for an
application, and are unlikely to raise suspicion on
the part of the victim."
There are 179 apps currently available on Android
app store Google Play that request this
information, the team add.
Activity such as listening to music, activating
maps, taking voice calls or using social media all
drain the battery but this can be discounted due
to "machine learning", the report says.
"Intuitively the reason why all this noise does not
mislead our algorithms is that the noise is not
correlated with the phone's location," it says.
"Therefore a sufficiently long power measurement
(several minutes) enables the learning algorithm
to 'see' through the noise."
The tests were carried out on phones using the
3G network but did not measure signal strength
as that data is protected by the device.
'Stuffed with sensors'
"With mobile devices now becoming ubiquitous, it
is troubling that we are seeing so many ways in
which they can be used to track us," said cyber-
security expert Prof Alan Woodward, from Surrey
University.
"I think people sometimes forget that
smartphones are stuffed full of sensors from
gyroscopes and GPS to the more obvious
microphones and cameras.
"This latest work shows that even that basic
characteristics (power consumption) has the
potential to invade privacy if monitored in the
right way," he added.
"We are approaching the point where the only
safe way to use your phone is to pull the battery
out - and not all phones let you do that."