国内Android应用商城中程序隐私泄露分析

Empirical study of privacy leakage in Android marketplaces in China

Android系统的开放性和Android应用商城缺乏有效的安全核查工具,导致以获取用户隐私信息为目的的程序不断涌现。该文聚焦于国内Android应用商城中程序隐私泄露问题,结合Android系统的权限机制,采用程序静态分析技术获取程序中疑似泄露路径,然后采用动态验证技术进行隐私泄露行为的确认。该文分析和研究了国内7个最具代表性的应用商城的330个热门程序,发现有58%的程序在用户隐私泄露方面存在问题。

Most mobile devices are now based on the Android operating system platform with almost all applications（called apps） downloaded from a few centralized software distribution sites,called marketplaces.However,the lack of effective security vetting mechanisms as well as the Android openness means that the marketplaces may unintentionally be hosting many apps developed by third parties who intend to manipulate and collect user privacy data for a variety of purposes.This paper reports an empirical study of the privacy leakage problem for about 330 of the most popular apps from seven representative Android marketplaces in China.A two-step process was used to minimize false alarms with each app initially examined by a static analysis tool and,if this examination reported suspicious code segments,the app was then tracked dynamically within a controlled run-time environment to identify the actual privacy leakage.The evaluation results show that more than 58% of the apps lead privacy data without user consent.