Study finds Android app-makers careless with some data

Researchers found 'widespread misuse' of data that should be kept private

A lot of the software written for Google's Android mobile phones falls short when it comes to user privacy and security.

Those are the conclusions of researchers from Pennsylvania State University and North Carolina State University, who took a look at the top 1,100 free applications available in the Android Market. They didn't find anything malicious, but a surprising number of the programs used unique identifiers such as the phone's IMEI (International Mobile Equipment Identity) number -- sometimes without obtaining permission to do so from the user.

One concern is that these unique identifiers could be linked to Android users in databases, essentially providing a stealthy way to track what mobile phone users are doing online, similar to the tracking cookies stored by Web browsers. Unlike a tracking cookie, a mobile phone's IMEI cannot be deleted.

The research follows up on work done by some of the same researchers who last year looked at 30 smartphone applications and found widespread sharing of location data and unique identifiers.

Researchers are only now beginning to put together a picture of what's going on beneath the surface with these mobile phone apps, said William Enck, an assistant professor with North Carolina State University and one of the authors of the study. "I think people are starting to become more aware of this, but I don't think there is widespread understanding of what the implications are," he said.

"The paper really expands our understanding of what applications under Android really are doing.... and what they are doing with our data," said Lee Tien, a staff attorney with the Electronic Frontier Foundation.

The EFF is concerned that these unique identifiers could be used to track consumer's online activity, but Tien did find some encouraging findings in the study, too. "I was kind of happy to see that there doesn't seem to be any obvious misuse of the audio video recording capacity for listening in and that sort of thing."

Enck and his fellow scientists built a program that took the Java bytecode that runs on Android phones and then decompiled it, converting it into something that humans could more easily look at and understand. In total, the researchers analyzed 21 million lines of code. Most of this work was done by computer but the Enck's team would often go in and manually inspect software that seemed interesting.

"Our analysis uncovered pervasive use/misuse of personal/phone identifiers and deep penetration of advertising and analysis networks," said the paper, which was presented this week at the Usenix Security Symposium in San Francisco.

The researchers call their work the "initial but not final word on Android application security."

One of the problems with this kind of analysis that the while it can show what programs are capable of doing, it doesn't prove that the Android apps are actually using their built in functionality when they are run on mobile phones.

Still, there findings are interesting. More than 22 percent of the applications the Penn State researchers looked at could send unique identifiers -- typically the IMEI identifier -- across the network.

Although there are times when programmers might want to actually want to use these unique identifiers -- to help police locate a stolen phone, for example -- they can easily be misused, and that can lead to serious security problems said Kevin Mahaffey, chief technology officer with mobile phone security software maker Lookout. "Any time you have a unique identifier... people tend to use it for all sorts of crazy purposes, particularly for authentication."

Verizon is one of those companies using IMEI for authentication, according to M.J. Keith, a security researcher with the Denim Group in San Antonio, Texas. All it takes is an IMEI and phone number in order to access Verizon's portal for mobile phone users, he said in an interview.

"You can actually use that to reset the portal password," he said. "You can take over the entire account, change the billing address. You can actually have a phone shipped to you."

Last month, Lookout reported that one of the application developers cited in the paper -- Callmejack -- had helped create more than 80 Android wallpaper applications that collected this type of data, sending it to servers in China.

Mahaffey believes that many developers reuse code that's been written by other developers, and that often this type of data collection may happen without the software maker even realizing that it's going on. "It puts developers in an interesting place if they're using opaque third-party code," he said. "If they have no idea that tracking is going on, it's very difficult for them to tell users about it."

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is

Join the PC World newsletter!

Error: Please check your email address.

Tags M.J. KeithWilliam EnckPennsylvania State UniversitymobileNorth Carolina State UniversityKevin MahaffeyprivacyElectronic Frontier FoundationVerizon Wirelessmobile applicationsLee TienGooglesecurityLookoutDenim Group

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?