Intriguing (and scary) research paper entitled “PlaceRaider: Virtual Theft in Physical Spaces with Smartphones”. Abstract reads:

As smartphones become more pervasive, they are increasingly targeted by malware. At the same time, each new generation of smartphone features increasingly powerful onboard sensor suites. A new strain of sensor malware has been developing that leverages these sensors to steal information from the physical environment (e.g., researchers have recently demonstrated how malware can listen for spoken credit card numbers through the microphone, or feel keystroke vibrations using the accelerometer). Yet the possibilities of what malware can see through a camera have been understudied. This paper introduces a novel visual malware called PlaceRaider, which allows remote attackers to engage in remote reconnaissance and what we call virtual theft. Through completely opportunistic use of the camera on the phone and other sensors, PlaceRaider constructs rich, three dimensional models of indoor environments. Remote burglars can thus download the physical space, study the environment carefully, and steal virtual objects from the environment (such as financial documents, information on computer monitors, and personally identifiable information). Through two human subject studies we demonstrate the effectiveness of using mobile devices as powerful surveillance and virtual theft platforms, and we suggest several possible defenses against visual malware.

PetaPixel has a useful summary of the essence of the idea:

The app, designed by Robert Templeman of the US Naval Surface Warfare Center and scientists at Indiana University, can run secretly in the background of any smartphone running Android 2.3 (after an unsuspecting “victim” launches the app, of course). It makes decisions on when to surreptitiously snap photos based on things like time, location, and orientation.

Useless images (ones that are too blurry or dark) are filtered out, while the rest are beamed to a central server, which creates virtual 3D spaces based on the content of the images. These 3D spaces can then be browsed by the person behind the malicious “hack”.

The whole thing isn’t just conceptual: the scientists actually gave infected phones to 20 oblivious test subjects, who were asked to use the devices like they normally would in office environments. The results were pretty crazy: 3D models were successfully obtained from every one of the 20 subjects, and it was easier to glean sensitive information from the 3D models than from the original photos.