I awoke this morning to find an email from
Evernote, the company that has the product
of the same name for note taking, saying that they had been hacked and
that I should change my password. T-Mobile installs this software,
along with many other pieces of software, on my smartphone by default
and does not allow the customer to remove it. Luckily the attack
against this product was not against the individual installations of the
software but rather against the parent server where all the information
is stored.
Unfortunately having unwanted software installed on phones is a security
problem. The basic rule is that if the software isn't installed on
one's computer then the software cannot be used as an attack vector. My
first smartphone came loaded with five pieces of software that I could
not remove. The Galaxy S that I purchased last November came with
thirty-nine. And that was just the pieces of software that are
visible. Last year we heard about
CarrierIQ being installed on nearly
every
smartphone
in America. This software had some very scary features that could allow
the cellphone carrier, the software owner, or anyone else able to break
into the software, access to everything contained within the phone and
every message sent and received (including key strokes).
There's another price to be paid for this mandatory software. Updates
need to be downloaded and installed which take up space on the
smartphone and uses up valuable bandwidth. With cellphone companies
complaining about usage of their wireless networks it seems silly that
some of this is required by the companies themselves.
So what to do about this problem? Cellphone companies should stop
preventing users from removing software from their phones. If they want
to load up the device with lots of software that they feel the user
might like that's fine but keeping people from removing that software is
wrong. If the companies won't stop this bad practice on their own then
perhaps if they get enough complaints from customers then they will
change their practices. I guess the only other option is rooting our
phones or just purchasing them outright. Still it shouldn't be so
difficult to maintain a secure computing environment. And with privacy
and so much money at stake the problem will only get worse.