There's an interesting report from a company called SnoopWall that is detailed in this YouTube video from a Special Report with Bret Baier with Fox News. In the report "Cybersecurity Expert" Gary Miliefsky, who works for SnoopWall, says phrases such as:

The top ten flashlight apps today that you can download from the Google Play store are all malware. They are malicious, spying, snooping, and stealing.

I've been tracking down where the stolen data is going and I've found three countries so far: China, India, and Russia.

They use this data pretty much for criminal purposes, but if a nation state wants to collect a lot of information on Americans this is a great way to do it.

To get rid of the problem you have to not only uninstall the flashlight apps, but you also need to factory reset your phone because the apps also install Trojans that remain there and wait to run and operate in the background while you are doing important things like mobile banking or reading your contacts list.

In the video Miliefsky refers to the Flashlight Apps Threat Assessment Report (PDF). The report appears to simply list the permissions that each app requests when you first install it. Whether that is a real threat or not does not seem to actually be discussed.

Snopes seems to have the same sentiment as others in the security industry.

The fact that a given app has access to data doesn't necessarily mean the app is actually using that data.

So what evidence is there to actually suggest that the top ten flashlight apps are collecting users' data and sending it off to China, India, and Russia for criminal purposes?

All of the above quotes are paraphrased from the youtube video.

  • If someone wants to take the time to exactly transcribe the quotes in the video that would be nice. The paraphrases are pretty close though.
    – user11643
    Oct 28, 2014 at 22:21
  • Steven Rambam, who is a notable expert in security, made a similar claim. Maybe you should reword your question to avoid specifying a number and probably also include a link to his talk.
    – Sklivvz
    Oct 29, 2014 at 9:50
  • 3
    Also, consider closing this here and opening it on Information Security -- it's unlikely that it will get a all-round answer here.
    – Sklivvz
    Oct 29, 2014 at 9:51
  • Just made a quick pass over the first 10 results for "flashlight" on the Google Play store, checking the app permissions. While several of the apps have permissions I wouldn't expect for such an app, the closest permission to this claim (which appeared on fewer than half of the first 10 results) was the ability to view available wifi networks.
    – Brian S
    Oct 29, 2014 at 14:26