Some applications based on the open-source Android operating system are secretly opening up too much to advertisers. That’s the word from a new study conducted by a research team from Duke University, Penn State University, and Intel Labs.
The study was conducted using the team’s new, real-time privacy monitoring tool, TaintDroid. The team reported that TaintDroid was used to monitor the behavior of 30 popular third-party Android applications, and it discovered 68 instances of “potential misuse of users’ private information across 20 applications.”
‘Coarse-Grained Controls’
The team noted that many Android apps, as well as those for other smartphones such as Apple’s iPhone, grab data from remote cloud services and combine that with data with local sensors, such as a GPS receiver, a camera, a microphone, or an accelerometer. This creates useful and legitimate functions for owners, the study noted, but sometimes private information is sent back to the cloud.
The study cited the hypothetical example of a user who allows her location information to be used by an application, but, because only “coarse-grained controls” are available, the user has no way of knowing that her location information will be sent to a location-based service, to advertisers, to the application developers, or to others.
TaintDroid labels, or “taints,” data originating from sources it considers private, and then logs the data as it travels through program variables, files and messages. The team said such tracking often has a high performance overhead, but they have integrated several techniques and utilized Android’s virtualized architecture to incur a runtime overhead of less than 14 percent.
For individual apps, the report said, the latency impact from TaintDroid was negligible. However, it noted that TaintDroid’s tracking can be circumvented by malicious application developers, in which case other techniques would need to be used.
Locations, Phone Numbers
In half of the 30 tested applications,…