How Does Misconfiguration of Analytic Services Compromise Mobile Privacy?Technical
Mobile application (app) developers commonly utilize analytic services to analyze their app users’ behavior to support debugging, service quality, and advertising. Anonymization and aggregation can reduce the sensitivity of behavioral data, and analytic services may encourage the use of these protections, however, developers can misconfigure the analytic services and expose personal information to greater privacy risk. Since people use apps in every aspect of their daily lives, apps may contain a lot of personal information, such as a user’s real-time location, health data, or dating preferences. To study this issue and identify potential privacy risks due to such misconfigurations, we developed a semi-automated approach, Privacy-Aware Analytics Misconfiguration Detector (PAMDroid), which enables the empirical analysis of modern analytic service practices. This paper describes a study of 1,000 top apps using top analytic services using PAMDroid in which we found misconfigurations in 120 apps, among which, 52 apps also cause a violation of either the analytic service providers’ terms of service or the app’s own privacy policy.
Thu 9 JulDisplayed time zone: (UTC) Coordinated Universal Time change
01:05 - 02:05 | P16-Security and LearningTechnical Papers / Journal First at Baekje Chair(s): Lingming Zhang The University of Texas at Dallas | ||
01:05 12mTalk | Software Visualization and Deep Transfer Learning for Effective Software Defect PredictionTechnical Technical Papers Jinyin Chen College of Information Engineering, Zhejiang University of Technology, Hangzhou 310023, China, Keke Hu College of Information Engineering, Zhejiang University of Technology, Hangzhou 310023, China, Yue Yu College of Computer, National University of Defense Technology, Changsha 410073, China, Zhuangzhi Chen College of Information Engineering, Zhejiang University of Technology, Hangzhou 310023, China, Qi Xuan Institute of Cyberspace Security, Zhejiang University of Technology, Hangzhou 310023, China, Yi Liu Institute of Process Equipment and Control Engineering, Zhejiang University of Technology, Hangzhou 310023, China, Vladimir Filkov University of California at Davis, USA | ||
01:17 8mTalk | Easy-to-Deploy API Extraction by Multi-Level Feature Embedding and Transfer LearningJ1 Journal First Suyu Ma Monash University, Zhenchang Xing Australia National University, Chunyang Chen Monash University, Cheng Chen PricewaterhouseCoopers Firm, Lizhen Qu Monash University, Guoqiang Li Shanghai Jiao Tong University | ||
01:25 12mTalk | How Does Misconfiguration of Analytic Services Compromise Mobile Privacy?Technical Technical Papers Xueling Zhang University of Texas at San Antonio, Xiaoyin Wang University of Texas at San Antonio, USA, Rocky Slavin University of Texas at San Antonio, Travis Breaux Carnegie Mellon University, Jianwei Niu University of Texas at San Antonio | ||
01:37 12mTalk | Securing UnSafe Rust Programs with XRust Technical Papers | ||
01:49 12mTalk | Is Rust Used Safely by Software Developers?Technical Technical Papers Ana Nora Evans University of Virginia, USA, Bradford Campbell University of Virginia, Mary Lou Soffa University of Virginia | ||