0

It appears that a number of apps on the market place require a number of 'permissions' such as permission to access the files/photos, text messages, contacts, browser history, etc of the phone, usually only when a very specific subset of this functionality is needed. This is an obvious privacy concern, and since there does not seem to be a way to protect user data on Android, it is important to identify apps which steal user data (to sell them to advertisers, or maliciously to sell on the black market, etc).

One way to do this would be to monitor the IP traffic generated by an app, but presumably it is common for such apps to use encryption e.g. SSL, in which case we would need to tamper with the certificates on the device to successfully execute MITM, etc. Not sure if it's feasible.

My question- has anyone worked on a framework to either reverse-engineer/introspect the apps (maybe to look for certain API calls which retrieve sensitive data, and observe where that data ends up) or monitor their network traffic, in a way that defeats encryption?

It would be interesting to take a look at a number of high-profile apps and see if they adhere to their 'privacy policy', or if they harvest everyone's data because they can get away with it.

On the other hand, I saw someone mention in another question (How to avoid leaking private data to apps without rooting my phone?) that we can read app source code to audit it for such things. Surely this is not true for all apps? Since not all apps are open source./

2
  • It should be noted that high profile apps' privacy policies are usually very stacked in favor of the developers.
    – Grimoire
    Nov 26 '17 at 14:27
  • The optimal solution for such intrusive apps is to tell the system to give them fake info: e.g., if it wants contacts, show an empty list &c. Alas, it appears that there is no easy way to do that.
    – sds
    Mar 29 '18 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy