Potentially unwanted applications such as adware, which displays ad content and may monitor user activity to provide targeted ads; trackware, which gathers data that can identify the device user to a third party; and spyware, which collects data about the user’s activity and content from the device to report back to a third party are also potential threats in the mobile landscape. Although these programs can have legitimate uses, they can also be annoying to the user or potentially be used for criminal purposes.

One of the more onerous mobile threats is mobile spyware: software that allows the attacker to monitor the activities of the target phone and its user. Mobile spyware is generally advertised as a legitimate tool for catching cheating spouses, girlfriends, or boyfriends; monitoring and protecting children from predators and cyberbullies; and monitoring employees for productivity purposes and to prevent and detect data theft. Mobile spyware programs can be purchased fairly inexpensively, and most work by using an installed application on the phone itself in conjunction with a web-based account that is used for reporting and monitoring activities on the target phone.

Different spyware packages have different monitoring capabilities, but most can track the location of the phone, intercept and report SMS and MMS messages, and report incoming and outgoing calls (sometimes allowing for recording or near real-time monitoring of calls). Some spyware can also be used to control the target phone to turn on the microphone to monitor the surroundings of the target phone or even to activate the camera to take video or still images remotely. Obviously, the opportunities to misuse mobile spyware to steal data, violate privacy, and illegally intercept and monitor phone calls are nearly endless. The presence of these software packages can be difficult to detect, but spyware should be suspected if a person reports that someone has inside knowledge of the content of private messages, emails, call content, or their physical location.

The following slides overview some of the mobile spyware programs on the market, but there are scores of different varieties of mobile spyware apps, and those apps may change over time; therefore, time and effort may be required on the examiner’s part to find artifacts of mobile spyware on a device.