Bug Fixes, Improvements, ... and Privacy Leaks: A Longitudinal Study of PII Leaks Across Android App Versions

Jingjing Ren, Martina Lindorfer, Daniel J. Dubois, Ashwin Rao, David Choffnes, Narseo Vallina-Rodriguez

Forskningsoutput: Kapitel i bok/rapport/konferenshandlingKonferensbidragVetenskapligPeer review

Sammanfattning

Is mobile privacy getting better or worse over time? In this paper, we address this question by studying privacy leaks from historical and current versions of 512 popular Android apps, covering 7,665 app releases over 8 years of app version history. Through automated and scripted interaction with apps and analysis of the network traffic they generate on real mobile devices, we identify how privacy changes over time for individual apps and in aggregate. We find several trends that include increased collection of personally identifiable information (PII) across app versions, slow adoption of HTTPS to secure the information sent to other parties, and a large number of third parties being able to link user activity and locations across apps. Interestingly, while privacy is getting worse in aggregate, we find that the privacy risk of individual apps varies greatly over time, and a substantial fraction of apps see little change or even improvement in privacy. Given these trends, we propose metrics for quantifying privacy risk and for providing this risk assessment proactively to help users balance the risks and benefits of installing new versions of apps.
Originalspråkengelska
Titel på gästpublikationProceedings 2018 Network and Distributed System Security Symposium
Antal sidor15
FörlagInternet Society
Utgivningsdatum2018
ISBN (elektroniskt)1891562495
DOI
StatusPublicerad - 2018
MoE-publikationstypA4 Artikel i en konferenspublikation
EvenemangNetwork and Distributed System Security Symposium - San Diego, Förenta Staterna (USA)
Varaktighet: 18 feb 201821 feb 2018

Vetenskapsgrenar

  • 113 Data- och informationsvetenskap

Citera det här