How easy is it to track your smartphone?

As we use our mobile phones for more and more complex tasks, we're perhaps forgetting just how much information we are giving them. These powerful handheld devices not only make phone calls and send text messages, they also track our location, our internet surfing activity and help us keep tabs on our social life via Facebook and Twitter.

The information stored on these devices is hugely personal, so what if someone was able to steal it? Worryingly, doing so is as simple as installing an app.

For the last couple of days I've been in San Francisco to see Norton as the company outlined current malware and virus threats and also looked at future trends, specifically those targeting smartphones.

We trust our smartphones more than perhaps we should. For a lot of people, their whole lives play out on these devices and so the information they contain gives a prettry comprehensive account of everything they do. Norton showed how simple it is to gain access to this information by the simple process of installing an app.

FlexiSpy, which has been around since 2006, is capable of tracking just about everything that happens on a smartphone from tapping phone-calls, triggering the microphone to bug conversations, access text messages and various other things. The full version costs around $350 (£213) per year and claims to work on numerous Android, Windows Mobile, Blackberry and Symbian devices, as well as 'jailbroken' iPhones. Norton demoed the software running on an Android smartphones to show what it can do.

In order for it to run on a device it has to be physically installed, so the person wishing to track someone has to get hold of their phone and install it in person. Once this is done, the application is almost totally invisible.

It won't show up in the list of installed applications and the only way to open it is to 'call' a special number. Only when this special number is entered will the app open. It doesn't even show up in the processes list in Android, either hiding itself completely or calling itself something innocuous like 'sync manager'. The information that it collects is then sent to an online account where the person doing the spying can access it.

It is able to track the phone's location via GPS, look at phone calls, text messages and internet activity. Scary stuff.

Norton also showed how inserting extra permissions into an innocuous looking app, in this case a puzzle game, can enable people to track and even control an Android phone.

Android applications are coded using a language called Java. This coding language can be 'undone'; basically, someone can alter existing code to insert additional permissions (to give the application access to everything on the Android smartphone, for example). This new and seemingly innocent looking app can then, in theory, be uploaded to the Android marketplace.

The app will still look like the original puzzle game, but have the additional tracking code 'hidden' within it. Should someone download this malicious version of puzzle game they will be informed that it requires permission to access everything on their phone (Android informs a user of all the permissions an application requests) but if the user ignores this or doesn't read it, once installed the app can track everything they do.

It was certainly an eye-opening presentation and a good reminder of the dangers of putting so much trust in devices like smartphones.