S3Corp. Tech Blog

Security researchers have developed an mobile application development that spies on the conversations of those around the phones it is installed on. But the purpose of the app isn’t to breach your privacy. Instead, it has been designed to demonstrate how your privacy might be breached, and how what you say could be used by search engines and advertising networks to make adverts that are even more targeted.

Let’s take a look at the evidence, and try to work out whether surveillance-driven advertising is really taking place, or if it is really nothing more than good, old-fashioned, coincidence.

When Your Phone Knows

Various users across the web have claimed that something fishy is going on with their phones. They believe that smartphone microphones are being used to record what they say, with the information used to better target Google ads on websites and Facebook.

It sounds unlikely, but the anecdotal evidence is quite compelling. BBC Technology Report Zoe Kleinman reports an occasion when she learned of a friend’s death in tragic circumstances, only to find that her friend’s name, the accident, location and year were in the Google search box on her phone.

Further stories on Reddit expand further, such as this from hawk8177:

i was talking to a friend about a med he takes, next day im getting ads about that med… i asked a friend something about the best way to defog car windows… the next day when i open youtube the very first suggestion for me to watch was how to defog windows!

Here’s another, from karlrocks23

My SO and I were having a chat and I was telling her about a new Nespresso shop that opened up in the city and how nicely designed it was. I don’t like coffee that much, and I’ve never even tried Nespresso. That is the only time I can remember having a conversation about Nespresso to anyone and I’ve certainly never Googled it or anything.

The next day, all my ads on chrome were about Nespresso.. I have no issues with ads popping up related to things I’ve searched by voice or type. But it did feel a bit invasive being constantly listened to and for private conversations to be used as a means to target ads at me.

So many of these stories can be found on Reddit and beyond. This one, about a user noticing Google ads for everything he discussed with his wife, is particularly interesting, although too long to reproduce here.

My Own Experience

Back in 2015, I noticed a startling similarity between my Google Now recommendations (Google Now is a popular Google alternative to Siri) and news updates, and the shows I’d recently been watching. Keen to avoid spoilers, I had resisted the temptation to search for anything about the programs, so it was a surprise to see them listed.

A few days later, I’d forgotten about this, until I noticed that after leaving my phone at my mum’s house, a bunch of new shows appeared in Google Now, along with the legend “Because of your interest in this show”. You’ll see two examples above: on the left, Fireman Sam, which often played on TV not far from my phone. On the right, British TV drama Heartbeat, selected because it was “Similar to Coronation Street” – a show watched in our house, but not Googled.

It won’t surprise you to learn that I don’t share the same taste in TV shows as my mum.

Google Now on Android offers precious little in the way of options that might disable the microphone, other than abandoning the launcher altogether. So to combat this, I’ve started leaving my phone in my home office when watching TV. At the very least, I get fewer interruptions, and the appearance on my phone of TV shows I’m watching — or are currently screening – has dropped to zero.

It does seem as though this is something more than coincidence. But can it be proven that smartphone mics are being used to collect data and target appropriate content at users?

What the App Does

To prove that other apps could be stealing data captured through your smartphone’s microphone, cybersecurity expert Ken Munro developed – with the help of David Lodge from Pen Test Partners – an app that would record what was being said in the vicinity of a phone, and display it on a PC monitor.

As Munro explained to the BBC,

“All we did was use the existing functionality of Google Android – we chose it because it was a little easier for us to develop in.”

“We gave ourselves permission to use the microphone on the phone, set up a listening server on the internet, and everything that microphone heard on that phone, wherever it was in the world, came to us and we could then have sent back customized ads.”

David Lodge went on to explain that much of the code was already available either within the OS or in the public domain, and it seems the experiment was achieved with minimal battery drain on the device.

Google “Categorically” Rejects Accusations

Google and Facebook have both denied that their apps can take advantage of smartphone microphones to gather information in this way. With Facebook telling the BBC that it blocks brands from advertising based on microphone data, and Google claiming “categorically” that it does not use any “utterances” from when theOK Google hotword is used, it seems unlikely that any of this really happens.

Additionally, Google developer policy — that all app developers must agree to — specifies that apps do not breach privacy in this way.

So what is going on? Are devices listening in? Are Google and Facebook using voice recognition software against us to make a profit? Or is it really all just coincidence? Have you had the uncanny feeling that what you just talked about has appeared as an ad on your phone? Tell us about it in the comments.