Abstract:With millions of apps provided from official and third-party markets, Android has become one of the most active mobile platforms in recent years. These apps facilitate people's lives in a broad spectrum of ways but at the same time touch numerous users' information, raising huge privacy concerns. To prevent leaks of sensitive information, especially from legitimate apps to malicious ones, developers are encouraged to store users' sensitive data into private folders which are isolated and securely protected. But for non-sensitive data, there is no specific guideline on how to manage them, and in many cases, they are simply stored on public storage which lacks fine-grained access control and is almost open to all apps.Such storage model appears to be capable of preventing privacy leaks, as long as the sensitive data are correctly identified and kept in private folders by app developers. Unfortunately, this is not true in reality. In this paper, we carry out a thorough study over a number of Android apps to examine how the sensitive data are handled, and the results turn out to be pretty alarming: most of the apps we surveyed fail to handle the data correctly, including extremely popular apps. Among these problematic apps, some directly store the sensitive data into public storage, while others leave non-sensitive data on public storage which could give out users' private information when being combined with data from other sources. An adversary can exploit these leaks to infer users' location, friends and other information without requiring any critical permission. We refer to both types of data as "non-shared" data, and argue that Android's storage model should be refined to protect the non-shared data if they are saved to public storage. In the end, we propose several approaches to mitigate such privacy leaks.

Identifying Superfluous Network Transmissions in Android Applications

Static Analysis of Superfluous Network Transmissions in Android Applications.

Detecting Passive Content Leaks and Pollution in Android Applications.

Fast, Scalable Detection of "piggybacked" Mobile Applications

Giving Without Notifying: Assessing Compliance of Data Transmission in Android Apps

LeakSemantic: Identifying Abnormal Sensitive Network Transmissions in Mobile Applications

Detecting Information Theft Based on Mobile Network Flows for Android Users

Signature Generation for Sensitive Information Leakage in Android Applications

AppIntent: analyzing sensitive data transmission in android for privacy leakage detection.

Mobile app identification for encrypted network flows by traffic correlation

Automatic Fingerprint Extraction of Mobile APP Users in Network Traffic

AnFlo: Detecting Anomalous Sensitive Information Flows in Android Apps

Taming the Android AppStore: Lightweight Characterization of Android Applications

Investigating Redundant Internet Video Streaming Traffic on iOS Devices: Causes and Solutions

Characterizing Sensor Leaks in Android Apps

SieveDroid: Intercepting Undesirable Private-Data Transmissions in Android Applications

Automatically Detecting Malicious Sensitive Data Usage in Android Applications

An Empirical Study On Android For Saving Non-Shared Data On Public Storage

Automatic Generation Of Mobile App Signatures From Traffic Observations

Who Moved My Cheese: Towards Automatic and Fine-Grained Classification and Modeling Ad Network

Trimming Mobile Applications for Bandwidth-Challenged Networks in Developing Regions