I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.

We are not using this option, and it is probably there by mistake. But the people who are responsible for this system don't see it as a big deal. Because “We are not going to use it”…

Am I wrong for going ballistic over it?

What would you do about it if it was your workplace?


  This question was IT Security Question of the Week.
  Read the Jun 16, 2012 blog entry for more details or submit your own Question of the Week.


Just because they won't use it, doesn't mean someone else won't find it and use it. 

A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money to fix. And what will your company say when people ask why the software contained that backdoor in the first place? The company's reputation might be damaged forever. 

The risk is certainly not worth having it in the code.
