AdDroid: privilege separation for applications and advertisers in Android

  • Authors:

  • Paul Pearce;Adrienne Porter Felt;Gabriel Nunez;David Wagner

  • Affiliations:

  • University of California Berkeley;University of California Berkeley;Sandia National Laboratory;University of California Berkeley

  • Venue:
  • Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Advertising is a critical part of the Android ecosystem---many applications use one or more advertising services as a source of revenue. To use these services, developers must bundle third-party, binary-only libraries into their applications. In this model, applications and their advertising libraries share permissions. Advertising-supported applications must request multiple privacy-sensitive permissions on behalf of their advertising libraries, and advertising libraries receive access to all of their host applications' other permissions. We conducted a study of the Android Market and found that 49% of Android applications contain at least one advertising library, and these libraries overprivilege 46% of advertising-supported applications. Further, we find that 56% of the applications with advertisements that request location (34% of all applications) do so only because of advertisements. Such pervasive overprivileging is a threat to user privacy. We introduce AdDroid, a privilege separated advertising framework for the Android platform. AdDroid introduces a new advertising API and corresponding advertising permissions for the Android platform. This enables AdDroid to separate privileged advertising functionality from host applications, allowing applications to show advertisements without requesting privacy-sensitive permissions.