一句话：提出半自动检测器 PAMDroid，并在 1000 款热门应用中发现 120 款存在分析服务错误配置，52 款违反服务条款或隐私政策。
移动应用开发者常使用分析服务来理解用户行为，以支持调试、提升服务质量并实现广告。匿名化与聚合可降低行为数据敏感性，但分析服务并不强制这些保护，开发者可能错误配置服务并暴露个人信息，带来实时位置、健康数据或约会偏好等敏感信息泄露风险。为研究该问题，作者提出半自动方法 PAMDroid（Privacy-Aware Analytics Misconfiguration Detector），用于检测分析服务的隐私相关错误配置，并据此对使用主流分析服务的 1000 款热门应用开展实证研究。结果发现 120 款应用存在错误配置，其中 52 款应用因错误配置违反分析服务提供商的服务条款或应用自身隐私政策。
Mobile application (app) developers commonly utilize analytic services to analyze their app users' behavior to support debugging, improve service quality, and facilitate advertising. Anonymization and aggregation can reduce the sensitivity of such behavioral data, therefore analytic services often encourage the use of such protections. However, these protections are not directly enforced so it is possible for developers to misconfigure the analytic services and expose personal information, which may cause greater privacy risks. Since people use apps in many aspects of their daily lives, such misconfigurations may lead to the leaking of sensitive personal information such as a users' real-time location, health data, or dating preferences. To study this issue and identify potential privacy risks due to such misconfigurations, we developed a semi-automated approach, Privacy-Aware Analytics Misconfiguration Detector (PAMDroid), which enables our empirical study on mis-configurations of analytic services. This paper describes a study of 1,000 popular apps using top analytic services in which we found misconfigurations in 120 apps. In 52 of the 120 apps, misconfigurations lead to a violation of either the analytic service providers' terms of service or the app's own privacy policy.
DOI 原文 ·
@inproceedings{paperbot5667,
title = {How does misconfiguration of analytic services compromise mobile privacy?},
author = {Xueling Zhang and Xiaoyin Wang and Rocky Slavin and Travis Breaux and Jianwei Niu},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380401}
}