[rloc]

So in order to track the phone he had to:

1) Get physical access to the phone and be able to unlock it.

2) Manually disable the Android setting so that non verified apps can be installed (the setting is enabled by default on almost every Google Android phone to protect users). By doing so a clear message warns the user that the phone will become vulnerable to attackers.

3) Install an obscure apk on the phone (side load or via link) outside of the Play Store.

I would call this just installing an app that is designed to track you. Such an app is trivial to code.

When you decide to set your OS free to make it possible to install anything then obviously you can install anything on it, including a spyware.

It makes no sense to compare this to iOS because iOS doesn't allow 2) (walled garden). Android leaves it up to you and thus provides more "freedom" to users. Freedom comes with additional risks. The equivalent is jailbreaking on iOS (unofficial).

I like to compare this with someone being locked in a room. This person is obviously less likely to die from a car accident than a free one. But does that mean you want to live locked in a room ?

[id122015]

What you said is exactly what I watched on youtube.

But my question is about desktop app, is it true that any app could contain malware ? Even popular apps like Transmission have been infected, how about those that are not popular and the antivirus doesnt know about ?

[rloc]

Yes.

Xcode was hacked not so long ago. The malware could remain invisible even to the creators of the app. Although it's less likely to remain unnoticed with open source projects due to the visible nature of it.

On desktop, Mac OS and Windows now provides official stores where apps are verified and signed.

On Android I remember Google added an app scanner in order to detect infected apps even when the security setting is disabled. On windows there is defender.

At the end of the day it's all about trust. Be very careful regarding where you download the software from.