Free for All! Assessing User Data Exposure to Advertising Libraries on Android

23rd Annual Network and Distributed System Security Symposium, NDSS 2016

Volumn , Issue , 2016, Pages

  Demetriou, Soteris ^a   Merrill, Whitney ^a   Yang, Wei ^a   Zhang, Aston ^a   Gunter, Carl A ^a  

^a UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANDROID (OPERATING SYSTEM); DATA MINING; LEARNING ALGORITHMS; LEARNING SYSTEMS; LIBRARIES; NATURAL LANGUAGE PROCESSING SYSTEMS; RISK ASSESSMENT; SENSITIVE DATA;

ADVERTIZING; DATA EXPOSURE; GROUND TRUTH; LEARN+; MOBILE APP; PRIVACY RISKS; SECURITY AND PRIVACY; SECURITY RISKS; USER DATA; USER INPUT;

MARKETING;

EID: 85014812568     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2016.23082     Document Type: Conference Paper

References (53)

1. Fda.gov. http://goo.gl/guSsMM. Accessed: 2015-01-05.
2. Pluto code base and experimental results. https://goo.gl/dxXI4O, Observed in May 2015.
3. R. Agrawal, R. Srikant, et al. Fast algorithms for mining association rules. In VLDB, 1994.
4. D. Amalfitano, A. R. Fasolino, P. Tramontana, S. De Carmine, and A. M. Memon. Using gui ripping for automated testing of android applications. In ACM ASE, 2012.
5. S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. Le Traon, D. Octeau, and P. McDaniel. Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. In PLDI, 2014.
6. S. Banerjee and T. Pedersen. An adapted lesk algorithm for word sense disambiguation using wordnet. In CICLing. 2002.
7. P. Barford, I. Canadi, D. Krushevskaja, Q. Ma, and S. Muthukrishnan. Adscape: Harvesting and analyzing online display ads. In WWW, 2014.
8. R. Bhoraskar, S. Han, J. Jeon, T. Azim, S. Chen, J. Jung, S. Nath, R. Wang, and D. Wetherall. Brahmastra: driving apps to test the security of third-party components. In USENIX Security, 2014.
9. M. D. Buhrmester, T. Kwang, and S. D. Gosling. Amazon’s Mechanical Turk: A new source of inexpensive, yet high-quality data? Perspectives on Psychological Science, 2011.
10. J. Carroll and T. Briscoe. High precision extraction of grammatical relations. In COLING, 2002.
11. developer.android.com. Ui/application exerciser monkey. http://goo.gl/ cH9wPR, Observed in May 2015.
12. S. Dredge. Twitter scanning users’ other apps to help deliver ‘tailored content’. The Guardian, November.
13. C. Duhigg. How companies learn your secrets. The New York Times, 16, 2012.
14. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In OSDI, 2010.
15. M. Fernández-Delgado, E. Cernadas, S. Barro, and D. Amorim. Do we need hundreds of classifiers to solve real world classification problems? J. Mach. Learn. Res., Jan. 2014.
16. M. A. Finlayson. Java libraries for accessing the princeton wordnet: Comparison and evaluation. In GWC, 2014.
17. C. Gibler, J. Crussell, J. Erickson, and H. Chen. Androidleaks: Automatically detecting potential privacy leaks in Android applications on a large scale. In TRUST, 2012.
18. M. C. Grace, W. Zhou, X. Jiang, and A.-R. Sadeghi. Unsafe exposure analysis of mobile in-app advertisements. In WiSec, 2012.
19. H. Haddadi, P. Hui, and I. Brown. Mobiad: private and scalable mobile advertising. In MobiArch, 2010.
20. J. Han, J. Pei, and Y. Yin. Mining frequent patterns without candidate generation. In SIGMOD, 2000.
21. S. Hao, B. Liu, S. Nath, W. G. Halfond, and R. Govindan. Puma: programmable ui-automation for large-scale dynamic analysis of mobile apps. In Mobisys, 2014.
22. G. Hirst and D. St-Onge. Lexical chains as representations of context for the detection and correction of malapropisms. WordNet: An electronic lexical database, 1998.
23. J. Huang, Z. Li, X. Xiao, Z. Wu, K. Lu, X. Zhang, and G. Jiang. Supor: Precise and scalable sensitive user input detection for android apps. In USENIX Security, 2015.
24. J. J. Jiang and D. W. Conrath. Semantic similarity based on corpus statistics and lexical taxonomy. arXiv.org, 1997.
25. Y. Jing, G. Ahn, Z. Zhao, and H. Hu. Towards automated risk assessment and mitigation of mobile application. Dependable and Secure Computing, IEEE Transactions on, 2014.
26. Y. Jing, G.-J. Ahn, Z. Zhao, and H. Hu. Riskmon: Continuous and automated risk assessment of mobile applications. In CODASPY, 2014.
27. S. Kaplan and B. J. Garrick. On the quantitative definition of risk. Risk Analysis, 1981.
28. C. Leacock and M. Chodorow. Combining local context and wordnet similarity for word sense identification. WordNet: An electronic lexical database, 1998.
29. I. Leontiadis, C. Efstratiou, M. Picone, and C. Mascolo. Don’t kill my ads!: balancing privacy in an ad-supported mobile application market. In HotMobile, 2012.
30. D. Lin. An information-theoretic definition of similarity. In ICML, 1998.
31. C. Mann and A. Starostin. A framework for static detection of privacy leaks in Android applications. In SAC, 2012.
32. G. A. Miller. Wordnet: a lexical database for english. CACM, 38(11), 1995.
33. V. Moonsamy, M. Alazab, and L. Batten. Towards an understanding of the impact of advertising on data leaks. IJSN, 7(3), 2012.
34. Y. Nan, M. Yang, Z. Yang, S. Zhou, G. Gu, and X. Wang. Uipicker: User-input privacy identification in mobile applications. In USENIX Security, 2015.
35. S. Nath. MAdScope: Characterizing mobile in-app targeted ads. In Mobisys, 2015.
36. P. Pearce, A. P. Felt, G. Nunez, and D. Wagner. Addroid: Privilege separation for applications and advertisers in Android. In ASIACCS, 2012.
37. R. Rada, H. Mili, E. Bicknell, and M. Blettner. Development and application of a metric on semantic nets. IEEE SMC, 1989.
38. P. Resnik. Using information content to evaluate semantic similarity in a taxonomy. arXiv.org, 1995.
39. P. Sawers. businessinsider.com. http://goo.gl/8g34xB, Observed in May 2015.
40. S. Shekhar, M. Dietz, and D. S. Wallach. AdSplit: Separating smartphone advertising from applications. In USENIX Security, 2012.
41. D. Smith. businessinsider.com. http://goo.gl/LNn0pi, Observed in May 2015.
42. E. Steel, C. Locke, E. Cadman, and B. Freese. How much is your personal data worth? Financial Times, June 2013.
43. R. Stevens, C. Gibler, J. Crussell, J. Erickson, and H. Chen. Investigating user privacy in Android ad libraries. In MoST, 2012.
44. L. Sweeney. k-Anonymity: A model for Protecting Privacy. Int. J. Uncertain. Fuzziness Knowl.-Based Syst., 2002.
45. J. Turow. The daily you: How the new advertising industry is defining your identity and your worth. Yale University Press, 2012.
46. Twitter. What is app graph in Twitter? https://goo.gl/scmc69, Observed in May 2015.
47. I. Ullah, R. Boreli, M. A. Kaafar, and S. S. Kanhere. Characterising user targeting for in-app mobile ads. In INFOCOM WKSHPS, 2014.
48. L. Vigneri, J. Chandrashekar, I. Pefkianakis, and O. Heen. Taming the Android appstore: Lightweight characterization of Android applications. arXiv.org, 2015.
49. D. T. Wagner, A. C. Rice, and A. R. Beresford. Device analyzer: Understanding smartphone usage. In MobiQuitous, 2013.
50. C. E. Wills and C. Tatar. Understanding what they do with what they know. In WPES, 2012.
51. Z. Wu and M. Palmer. Verbs semantics and lexical selection. In ACL, 1994.
52. Z. Yang, M. Yang, Y. Zhang, G. Gu, P. Ning, and X. S. Wang. AppIntent: Analyzing sensitive data transmission in android for privacy leakage detection. In CCS, 2013.
53. Y. Zhou, X. Zhang, X. Jiang, and V. W. Freeh. Taming informationstealing smartphone applications (on android). In TRUST, 2011.