Research on Android apps finds no evidence of apps eavesdropping on audio

A group of scientists, most of them from Northeastern University in the US, analyzed 17,260 Android apps, looking at the recording and transmission of audio and video. They found no evidence of apps eavesdropping on audio.

The scientists have for them research analyzed a total of more than 17,000 Android apps, of which 15,627 were unique APKs from Google’s Play Store. The rest of the apps came from other app stores, such as AppChina, Mi.com, and Anzhi. They did a static analysis of the entire collection, looking at camera and microphone permissions, api references in the code, and whether those references come from the app developer or a third party. They also performed a dynamic analysis, looking at the traffic an app sends over the network, focusing on videos, audio, and images. While they found no evidence of apps stealthily recording audio and then relaying it, they did encounter a number of other phenomena that raise concerns.

A first finding is that many apps request permissions for the use of the camera and microphone, in the case of Google Play apps about eighty percent, but that those permissions are not always actually used. This would be a risk, because third-party software libraries could abuse these permissions without the app developer knowing. They offer several explanations for the phenomenon, including the claim that there is little documentation about the relationship between permissions and the associated APIs. Also copy-and-paste instructions from SDKs with too many permissions could cause this phenomenon.

The study also showed that only a fraction of the investigated apps actually resulted in a media leak, for example, in which media files were sent via the network against the user’s expectations. The researchers did not have enough resources to analyze all apps, so they limited themselves to a selection of 9100. It turned out that 21 apps sent media, 20 sent images and one sent video. They classified nine apps as media leaks, which equates to about 0.01 percent. For example, photo editing apps forwarded unsolicited photos to a server.

Data traffic per app

In their paper, the researchers highlight several interesting discoveries, including the app that forwarded video. It turned out to be the app GoPuff, a kind of delivery service. It sent images of all interactions after starting the app to a domain of Appsee, a service that promises to provide insight into the way users interact with an app. A spokesperson for GoPuff late to Gizmodo know that it has since removed the Appsee-sdk from its apps. Appsee tells the site that the app’s behavior is due to GoPuff, because the developers allegedly misused its service and violated its terms.

One of the authors of the paper tells Gizmodo: “We saw no evidence that people’s conversations are surreptitiously recorded.” He adds: “What people don’t seem to understand is that there’s a lot of other tracking in everyday life that doesn’t use your phone’s camera or microphone and allows a third party to get an equally complete picture of you. gives.” In their research, the scientists identify the possible shortcomings of their method, indicating that they may have overlooked other leaks. The researchers plan to present the paper, titled Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications, at the Proceedings on Privacy Enhancing Technologies symposium in Barcelona.