Bug Fixes, Improvements, ... and Privacy Leaks - A Longitudinal Study of PII Leaks Across Android App Versions

Abstract

Abstract-Is mobile privacy getting better or worse over time? In this paper, we address this question by studying privacy leaks from historical and current versions of 512 popular Android apps, covering 7,665 app releases over 8 years of app version history. Through automated and scripted interaction with apps and analysis of the network traffic they generate on real mobile devices, we identify how privacy changes over time for individual apps and in aggregate. We find several trends that include increased collection of personally identifiable information (PII) across app versions, slow adoption of HTTPS to secure the information sent to other parties, and a large number of third parties being able to link user activity and locations across apps. Interestingly, while privacy is getting worse in aggregate, we find that the privacy risk of individual apps varies greatly over time, and a substantial fraction of apps see little change or even improvement in privacy. Given these trends, we propose metrics for quantifying privacy risk and for providing this risk assessment proactively to help users balance the risks and benefits of installing new versions of apps.

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

“…Other studies have focused on data sharing with third parties. In a longitudinal study Ren et al [43] observed 512 Android apps over eight years of version history and concluded that the increased number of third party domains receiving data lead to higher privacy risk over time. Because third party libraries and their host apps have access to the same Android app permissions, it is often difficult to discern who is processing what data.…”

Reducing Permission Requests in Mobile Apps

“…There are a number of reasons why an app may request permissions outside of those needed for its core functionality, such as for analytics, personalization, testing, performance assessment, advertising (especially for free apps), or support for (unused) functionality in libraries that the app includes. Prior research has shown that many mobile apps request potentially unnecessary permissions [21,27,29] or permissions that are not directly related to their core functionality [2,8,17,24,28,35], or use permissions in unexpected ways [21]. This has also been reported by the press [12,33,37].…”

Characterizing Location-based Mobile Tracking in Mobile Ad Networks

“…Demetriou et al [11] present the first measurement system to reveal the potential risk of ad libraries in mobile apps. Recently, researchers have discovered that the third-party ad libraries in mobile apps misuse their inherited permission and access rights to learn and track users' private information without explicit consent [6], [7]. Both static and dynamic analyses tools have been developed to detect privacy leakage in mobile apps.…”

“…We install Mitmproxy certificate on the mobile device to decrypt the HTTPs traffic. We also use Monkey, a popular input generation tool used extensively [7], [17], to automate the app interaction by randomly injecting user event sequences. We let Monkey interact with each app for five minutes in order to generate enough traffic for analysis.…”