Exploring the Eastern Frontier: A First Look at Mobile App Tracking in China

Wang, Zhaohua; Li, Zhenyu; Xue, Minhui; Tyson, Gareth

doi:10.1007/978-3-030-44081-7_19

Cited by 4 publications

(3 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traffic Analysis: It has been shown that a vast amount of PII is directly embedded in queries, headers or post body of HTTP requests. By using ISP traffic logs or self-collected datasets, numerous mobile advertising and tracking services were uncovered, in which persistent identifiers including IMEI, IMSI, MAC address and advertising IDs are often transmitted [21,24,32,33]. Note that most of the services are hosted by third-party companies instead of phone vendors.…”

Section: Related Workmentioning

confidence: 99%

Android OS Privacy Under the Loupe -- A Tale from the East

Liu¹,

Leith²,

Patras³

2023

Preprint

View full text Add to dashboard Cite

China is currently the country with the largest number of Android smartphone users. We use a combination of static and dynamic code analysis techniques to study the data transmitted by the preinstalled system apps on Android smartphones from three of the most popular vendors in China. We find that an alarming number of preinstalled system, vendor and third-party apps are granted dangerous privileges. Through traffic analysis, we find these packages transmit to many third-party domains privacy sensitive information related to the user's device (persistent identifiers), geolocation (GPS coordinates, network-related identifiers), user profile (phone number, app usage) and social relationships (e.g., call history), without consent or even notification. This poses serious deanonymization and tracking risks that extend outside China when the user leaves the country, and calls for a more rigorous enforcement of the recently adopted data privacy legislation.

show abstract

Section: Related Workmentioning

confidence: 99%

Android OS Privacy Under the Loupe -- A Tale from the East

Liu¹,

Leith²,

Patras³

2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Nikiforakis et al [44] demonstrated in 2012 that large proportions of websites rely on JavaScript libraries hosted on ill-maintained external web servers, making JavaScript exploits trivial. Wang et al [57] studied use of third parties in China, highlighting differences to Western studies. Lauinger et al [38] led a further study, classifying sensitive libraries and the vulnerabilities caused by them.…”

Section: Related Workmentioning

confidence: 99%

Measuring and Analysing the Chain of Implicit Trust

Ikram

Masood

Tyson

et al. 2020

ACM Trans. Priv. Secur.

Self Cite

View full text Add to dashboard Cite

The web is a tangled mass of interconnected services, whereby websites import a range of external resources from various third-party domains. The latter can also load further resources hosted on other domains. For each website, this creates a dependency chain underpinned by a form of implicit trust between the first-party and transitively connected third parties. The chain can only be loosely controlled as first-party websites often have little, if any, visibility on where these resources are loaded from. This article performs a large-scale study of dependency chains in the web to find that around 50% of first-party websites render content that they do not directly load. Although the majority (84.91%) of websites have short dependency chains (below three levels), we find websites with dependency chains exceeding 30. Using VirusTotal, we show that 1.2% of these third parties are classified as suspicious—although seemingly small, this limited set of suspicious third parties have remarkable reach into the wider ecosystem. We find that 73% of websites under-study load resources from suspicious third parties, and 24.8% of first-party webpages contain at least three third parties classified as suspicious in their dependency chain. By running sandboxed experiments, we observe a range of activities with the majority of suspicious JavaScript codes downloading malware.

show abstract

“…To the best of our knowledge this work is the first in-depth measurement study of the data privacy practices of popular proprietary variants of the Android OS. The analysis of whether mobile apps disclose sensitive information to their associated back-end servers has been the focus of much research [3][4][5][6][7][8], especially with a view to risks such user de-anonymization, location tracking, behaviour profiling, and cross-linking of data by different stakeholders in the device/software supply chain. Probably closest to the present work are recent analyses of the data that web browsers share with their back-end servers [9] and of the data shared by Google Play Services [10][11][12].…”

Section: Introductionmentioning

confidence: 99%

On the data privacy practices of Android OEMs

2023

View full text Add to dashboard Cite

In this paper we present the first in-depth measurement study looking at the data privacy practices of the proprietary variants of the Android OS produced by Samsung, Xiaomi, Huawei and Realme. We address two questions: how are identifiers used in network connections and what types of data are transmitted. To answer these, we decrypt and decode the network traffic transmitted by a range of Android handsets. We find that all of the OEMs make undue use of long-lived hardware identifiers such as the hardware serial number, handset IMEI and so fail to follow best privacy practice. Hardware identifiers are also linked to the handset user’s real identity when they sign in to an OEM account on the handset. All of the OEMs collect the list of apps installed in a handset. This is a privacy concern since the list of installed apps can be used to profile user traits and preferences. All of the OEMs collect analytics/telemetry data, raising obvious privacy concerns.

show abstract

Exploring the Eastern Frontier: A First Look at Mobile App Tracking in China

Cited by 4 publications

References 24 publications

Android OS Privacy Under the Loupe -- A Tale from the East

Android OS Privacy Under the Loupe -- A Tale from the East

Measuring and Analysing the Chain of Implicit Trust

On the data privacy practices of Android OEMs

Contact Info

Product

Resources

About