Information leakage through mobile analytics services

Authors:
Terence Chen;Imdad Ullah;Mohamed Ali Kaafar;Roksana Boreli
Affiliations:
National ICT Australia and University of New South Wales, Australia;National ICT Australia and University of New South Wales, Australia;National ICT Australia and INRIA, France;National ICT Australia and University of New South Wales, Australia
Venue:
Proceedings of the 15th Workshop on Mobile Computing Systems and Applications
Year:
2014

Citing 6
Cited 0

TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
A study of android application security

SEC'11 Proceedings of the 20th USENIX conference on Security
Permission re-delegation: attacks and defenses

SEC'11 Proceedings of the 20th USENIX conference on Security
Don't kill my ads!: balancing privacy in an ad-supported mobile application market

Proceedings of the Twelfth Workshop on Mobile Computing Systems & Applications
MockDroid: trading privacy for application functionality on smartphones

Proceedings of the 12th Workshop on Mobile Computing Systems and Applications
Unsafe exposure analysis of mobile in-app advertisements

Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper we investigate the risk of privacy leakage through mobile analytics services and demonstrate the ease with which an external adversary can extract individual's profile and mobile applications usage information, through two major mobile analytics services, i.e. Google Mobile App Analytics and Flurry. We also demonstrate that it is possible to exploit the vulnerability of analytics services, to influence the ads served to users' devices, by manipulating the profiles constructed by these services. Both attacks can be performed without the necessity of having an attacker controlled app on user's mobile device. Finally, we discuss potential countermeasures (from the perspectives of different parties) that may be utilized to mitigate the risk of individual's personal information leakage.