Leave my apps alone!

Abstract

To enable app interoperability, the Android platform exposes installed application methods (IAMs), i.e., APIs that allow developers to query for the list of apps installed on a user's device. It is known that information collected through IAMs can be used to precisely deduce end-users interests and personal traits, thus raising privacy concerns. In this paper, we present a large-scale empirical study investigating the presence of IAMs in Android apps and their usage by Android developers. Our results highlight that: (i) IAMs are widely used in commercial applications while their popularity is limited in open-source ones; (ii) IAM calls are mostly performed in included libraries code; (iii) more than one-third of libraries that employ IAMs are advertisement libraries; (iv) a small number of popular advertisement libraries account for over 33% of all usages of IAMs by bundled libraries; (v) developers are not always aware that their apps include IAMs calls. Based on the collected data, we confirm the need to (i) revise the way IAMs are currently managed by the Android platform, introducing either an ad-hoc permission or an opt-out mechanism and (ii) improve both developers and end-users awareness with respect to the privacy-related concerns raised by IAMs.

On the data privacy practices of Android OEMs

“…The set of apps installed is also more likely to be unique to one handset, or a small number of handsets, and so can act as a device fingerprint (especially when combined with device hardware/system configuration data). See, for example, [ 15 , 16 , 25 – 27 ] for recent analyses of such privacy risks. We note that in light of such concerns, Google recently categorised the list of apps installed as “personal and sensitive user data” and introduced restrictions on Play Store apps collection of this data [ 28 ], but such restrictions do not apply to system apps since these are not installed via the Google Play store.…”

“…One example of potentially sensitive metadata is the list of apps installed on a handset. This can reveal user interests and traits [ 15 , 16 ]. The list of apps can also acts as a handset fingerprint, unique to only a small number of handsets, and so be used for tracking.…”