Microsoft and Lenovo have addressed the risk posed by the Superfish root certificate, but the problem may extend to the mobile versions of their products, as they were found to contain code that can track users.
The mobile equivalent of Superfish is called LikeThat and will be available for iOS and Android, from their respective app stores.
The app is designed to help users buy furniture by taking photos of desired items. The image is then uploaded to servers and visually similar results are provided by thousands of retailers.
Jonathan Zdziarski, an iOS forensics expert, examined the app's code and discovered that it includes features that assign each device a unique identity and preserve the EXIF data available in photos taken by the user and sent to servers.
The ID code, which has also been sent to an analytics company, has been assigned to the device without any notification to the user and could be derived based on the mobile gadget.
Regarding EXIF data associated with images, the privacy risk is ignored because it may contain the GPS location and the time the image was taken. Therefore, multiple images from different locations can track a user's steps over a specific period of time.
The researcher found that LikeThat for iOS is quite invasive and includes code that can retrieve information about the device, such as free disk space, MAC address, memory used, CPU frequency, or screen type.
If location services are enabled on the device, then Superfish no longer needs to invoke metadata from photos, as the GPS location is delivered by those services. Zdziarski notes that on iOS, user permission is required.
In a blog post on Friday, he also points out that, while these tracking capabilities may not be active in the iOS or Android versions of the app, the ability to collect and transmit the user's location is present within the SFLocationAPI class.
