“It’s Shocking!": Analysing the Impact and Reactions to the A3: Android Apps Behaviour Analyser

Hatamian, Majid; Kitkowska, Agnieszka; Korunovska, Jana; Kirrane, Sabrina

doi:10.1007/978-3-319-95729-6_13

Cited by 11 publications

(9 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We monitored the permission access patterns of apps within our data set. The apps were installed on several devices that had a pre-configured data capture tool described in [47], [48] to record API accesses from the OS. The collected logs were then analyzed and interpreted to determine apps permission access patterns.…”

Section: B Step2: Action (Real Permission Usage) Analysismentioning

confidence: 99%

Engineering Privacy in Smartphone Apps: A Technical Guideline Catalog for App Developers

Hatamian

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

With the rapid growth of technology in recent years, we are surrounded by or even dependent on the use of technological devices such as smartphones as they are now an indispensable part of our life. Smartphone applications (apps) provide a wide range of utilities such as navigation, entertainment, fitness, etc. To provide such context-sensitive services to users, apps need to access users' data including sensitive ones, which in turn, can potentially lead to privacy invasions. To protect users against potential privacy invasions in such a vulnerable ecosystem, legislation such as the European Union General Data Protection Regulation (EU GDPR) demands best privacy practices. Therefore, app developers are required to make their apps compatible with legal privacy principles enforced by law. However, this is not an easy task for app developers to comprehend purely legal principles to understand what needs to be implemented. Similarly, bridging the gap between legal principles and technical implementations to understand how legal principles need to be implemented is another barrier to develop privacy-friendly apps. To this end, this paper proposes a privacy and security design guide catalog for app developers to assist them in understanding and adopting the most relevant privacy and security principles in the context of smartphone apps. The presented catalog is aimed at mapping the identified legal principles to practical privacy and security solutions that can be implemented by developers to ensure enhanced privacy aligned with existing legislation. Through conducting a case study, it is confirmed that there is a significant gap between what developers are doing in reality and what they promise to do. This paper provides researchers and developers of privacy-related technicalities an overview of the characteristics of existing privacy requirements needed to be implemented in smartphone ecosystems, on which they can base their work.

show abstract

Section: B Step2: Action (Real Permission Usage) Analysismentioning

confidence: 99%

Engineering Privacy in Smartphone Apps: A Technical Guideline Catalog for App Developers

Hatamian

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Surprisingly, all the analyzed iOS apps had at least 3 top risks. Due to such shocking statistics, an in-depth vulnerability analysis is required to investigate the potential vulnerabilities imposed by the Behavior Analyzer Behavior Analyzer (BA) is an extension of our previous work [18,20] and a monitoring tool that analyzes the behavior of employee's installed apps. In contrast to run-time monitoring, where one could conclude what an employee was doing, we analyze the apps' behavior only by looking at the apps' permission requests.…”

Section: Componentsmentioning

confidence: 99%

ESARA: A Framework for Enterprise Smartphone Apps Risk Assessment

Hatamian

Pape

Rannenberg

2019

ICT Systems Security and Privacy Protection

Self Cite

View full text Add to dashboard Cite

Protecting enterprise's confidential data and infrastructure against adversaries and unauthorized accesses has been always challenging. This gets even more critical when it comes to smartphones due to their mobile nature which enables them to have access to a wide range of sensitive information that can be misused. The crucial questions here are: How the employees can make sure the smartphone apps that they use are trustworthy? How can the enterprises check and validate the trustworthiness of apps being used within the enterprise network? What about the security and privacy aspects? Are the confidential information such as passwords, important documents, etc. are treated safely? Are the employees' installed apps monitoring/spying the enterprise environment? To answer these questions, we propose Enterprise Smartphone Apps Risk Assessment (ESARA) as a novel framework to support and enable enterprises to analyze and quantify the potential privacy and security risks associated with their employees' installed apps. Given an app, ESARA first conducts various analyses to characterize its vulnerabilities. Afterwards, it examines the app's behavior and overall privacy and security perceptions associated with it by applying natural language processing and machine learning techniques. The experimental results using app behavior and perception analyses indicate that: (1) ESARA is able to examine apps' behavior for potential invasive activities; and (2) the analyzed privacy and security perceptions by ESARA usually reveal interesting information corresponding to apps' behavior achieved with high accuracy.

show abstract

“…Similarly, in [6], a remodelling of PrP documents is proposed, as well as an Annotator for visualizing them using semantic metadata. Tools for improving privacy awareness using visual techniques have appeared in [7,8], whereas [9] presents an app which enables users to behaviourally analyse the privacy aspects of other installed apps.…”

Section: Related Workmentioning

confidence: 99%

Evaluating the Data Privacy of Mobile Applications Through Crowdsourcing

Chrysakis

Flouris

Ioannidis³

et al. 2020

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

Consumers are largely unaware regarding the use being made to the data that they generate through smart devices, or their GDPR-compliance, since such information is typically hidden behind vague privacy policy documents, which are often lengthy, difficult to read (containing legal terms and definitions) and frequently changing. This paper describes the activities of the CAP-A project, whose aim is to apply crowdsourcing techniques to evaluate the privacy friendliness of apps, and to allow users to better understand the content of Privacy Policy documents and, consequently, the privacy implications of using any given mobile app. To achieve this, we developed a set of tools that aim at assisting users to express their own privacy concerns and expectations and assess the mobile apps’ privacy properties through collective intelligence.

show abstract

“It’s Shocking!": Analysing the Impact and Reactions to the A3: Android Apps Behaviour Analyser

Cited by 11 publications

References 15 publications

Engineering Privacy in Smartphone Apps: A Technical Guideline Catalog for App Developers

Engineering Privacy in Smartphone Apps: A Technical Guideline Catalog for App Developers

ESARA: A Framework for Enterprise Smartphone Apps Risk Assessment

Evaluating the Data Privacy of Mobile Applications Through Crowdsourcing

Contact Info

Product

Resources

About