A detailed study on risk assessment of mobile app permissions

Abstract

Mobile phone have user's personal and private information. When mobile applications have the permission to access to this information they may leak it to third parties without user's consent for their own benefits. As users are not aware of how their personal information would be used once applications are installed and permissions are granted, this raises a potential privacy concern. Therefore, there is a need for a risk assessment model that can intimate the users about the threats the mobile application poses to the user's private information. We propose an approach that helps in increasing user's awareness of the privacy risk involved with granting permissions to Android applications. The proposed model focuses on the requested permissions of the application and determines the risk based on the permission set asked and gives a risk score.

Towards a systematic description of the field using bibliometric analysis: malware evolution

“…The level of risk is measured based on the impact of the mobile attack. As mobile device functions grow drastically to compete with the new emergence of design among developers in the market place, mobile users face higher risks (Naga Malleswari et al 2017 ). Risk analysis is thus analysed by some procedures, such as categorising the risk, triggers, effects of the risk, re-evaluating the possibility of the risk, and finding the factor to mitigate the risk (Sharma and Gupta 2018b ; B 2018 ).…”

“…Leading a risk assessment is interesting due to less awareness on its effect on risk decision making. A study by Naga Malleswari et al ( 2017 ) helped to improve users’ awareness by presenting the privacy risk for users before granting permission. Similarly, a study by Alali et al ( 2018 ) proposed the Fuzzy Inference Model (FIS) which determines four (4) factors of risk: threat, vulnerability, impact, and likelihood.…”

A systematic literature review of the factors affecting smartphone user threat avoidance behaviour

“…The risk of unauthorised access to sensitive information, which may be acquired through interception of information, malware (Balaganesh et al, 2018;Yan and Yan, 2018), phishing and subscriber identification module swaps (Buku and Mazer, 2017), represents a major threat. If unauthorised access to aspects such as login names, bank account numbers, usernames and passwords is obtained, it may be used by criminals for fraudulent purposes, such as identity theft and financial fraud (Balaganesh et al, 2018;Bouazzouni et al, 2018;Buku and Mazer, 2017;Malleswari et al, 2018;Zhang et al, 2017).…”

“…Mobile malware represents malicious programs developed specifically by malware authors to exploit typical properties associated with mobile devices, such as its mobility and connectivity capabilities. Malware can be downloaded onto smartphones without the user's knowledge and consent (Yan and Yan, 2018;Zhang et al, 2017) and can for example access and use sensitive data and information such as calls and messages, contacts and call history, location information and keystrokes (Balaganesh et al, 2018;Bouazzouni et al, 2018;Malleswari et al, 2018;Unuchek, 2018). Mobile malware is growing exponentially (Abawajy et al, 2018).…”

“…Mobile malware is growing exponentially (Abawajy et al, 2018). Negative consequences associated with malware include unauthorised access to information, slowing-down or even rendering phones unusable, "pushing" unwanted and fake apps, that users have to pay for, on unsuspecting users and draining the phone's battery or preventing the phone from going to sleep-mode, enabling malware activities to take place in the background (Das and Ullah Khan, 2016;Davis and Samani, 2018;Malleswari et al, 2018;Unuchek, 2018). Some downloaded apps can increase users' susceptibility to mobile threats.…”