Publications
Peer-reviewed papers
-
Mules and Permission Laundering in Android: Dissecting Custom Permissions in the Wild [PDF]
-
Log: It's Big, It's Heavy, It's Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem [PDF]
- Mixed Signals: Analyzing Software Attribution Challenges in the Android Ecosystem [PDF]
- Not Your Average App: A Large-scale Privacy Analysis of Android Browsers [PDF]
- Trouble Over-The-Air: An Analysis of FOTA Apps in the Android Ecosystem [PDF]
- Blocklist babel: On the Transparency and Dynamics of Open Source Blocklisting [PDF]
- Mis-shapes, Mistakes, Misfits: An Analysis of Domain Classification Services [PDF]
- An Analysis of Pre-installed Android Software [PDF]
- Don't Accept Candy from Strangers: An Analysis of Third-Party Mobile SDKs [PDF]
- Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem [PDF]
-
A Long Way to the Top: Significance, Structure, and Stability of Internet Top Lists
[PDF]
- An Analysis of Pre-installed Android Software [PDF]
- This Is My Private Business! Privacy Risks on Adult Websites [PDF]
- BGP Table Fragmentation: what & who? [PDF]
Thesis
- "Do Android Dream of Electric Sheep?" On Privacy in the Android Supply Chain [PDF] [slides]
- Conception rules for IGP and iBGP topologies to ensure BGP correctness [PDF] [slides]
Abstract
The Android Open Source Project (AOSP) was first released by Google in 2008 and has since become the most used operating system. Thanks to the openness of its source code, any smartphone vendor or original equipment manufacturer (OEM) can modify and adapt Android to their specific needs, or add proprietary features before installing it on their devices in order to add custom features to differentiate themselves from competitors. This has created a complex and diverse supply chain, completely opaque to end-users, formed by manufacturers, resellers, chipset manufacturers, network operators, and prominent actors of the online industry that partnered with OEMs. Each of these stakeholders can pre-install extra apps, or implement proprietary features at the framework level.
However, such customizations can create privacy and security threats to end-users. Pre-installed apps are privileged by the operating system, and can therefore access system APIs or personal data more easily than apps installed by the user. Unfortunately, despite these potential threats, there is currently no end-to-end control over what apps come pre-installed on a device and why, and no traceability of the different software and hardware components used in a given Android device. In fact, the landscape of pre-installed software in Android and its security and privacy implications has largely remained unexplored by researchers.
In this thesis, I investigate the customization of Android devices and their impact on the privacy and security of end-users. Specifically, I perform the first large-scale and systematic analysis of pre-installed Android apps and the supply chain. To do so, I first develop an app, Firmware Scanner, to crowdsource close to 34,000 Android firmware versions from 1,000 different OEMs from all over the world. This dataset allows us to map the stakeholders involved in the supply chain and their relationships, from device manufacturers and mobile network operators to third-party organizations like advertising and tracking services, and social network platforms. I could identify multiple cases of privacy-invasive and potentially harmful behaviors. My results show a disturbing lack of transparency and control over the Android supply chain, thus showing that it can be damageable privacy- and security-wise to end-users.
Next, I study the evolution of the Android permission system, an essential security feature of the Android framework. Coupled with other protection mechanisms such as process sandboxing, the permission system empowers users to control what sensitive resources (e.g., user contacts, the camera, location sensors) are accessible to which apps. The research community has extensively studied the permission system, but most previous studies focus on its limitations or specific attacks. In this thesis, I present an up-to-date view and longitudinal analysis of the evolution of the permissions system. I study how some lesser-known features of the permission system, specifically permission flags, can impact the permission granting process, making it either more restrictive or less. I then highlight how pre-installed apps developers use said flags in the wild and focus on the privacy and security implications. Specifically, I show the presence of third-party apps, installed as privileged system apps, potentially using said features to share resources with other third-party apps.
Another salient feature of the permission system
is its extensibility: apps can define their own
custom permissions to expose features and data to
other apps. However, little is known about how
widespread the usage of custom permissions is, and
what impact these permissions may have on users’
privacy and security. In the last part of this
thesis, I investigate the exposure and request of
custom permissions in the Android ecosystem and
their potential for opening privacy and security
risks. I gather a 2.2-million-app-large dataset of
both pre-installed and publicly available apps
using both Firmware Scanner and purpose-built app
store crawlers. I find the usage of custom
permissions to be pervasive, regardless of the
origin of the apps, and seemingly growing over
time. Despite this prevalence, I find that custom
permissions are virtually invisible to end-users,
and their purpose is mostly undocumented. While
Google recommends that developers use their reverse
domain name as the prefix of their custom
permissions, I find widespread violations of this
recommendation, making sound attribution at scale
virtually impossible. Through static analysis
methods, I demonstrate that custom permissions can
facilitate access to permission-protected system
resources to apps that lack those permissions,
without user awareness. Due to the lack of tools
for studying such risks, I design and implement two
tools, PermissionTracer and
PermissionTainter to study custom
permissions. I highlight multiple cases of
concerning use of custom permissions by Android
apps in the wild.
In this thesis, I systematically studied, at scale, the vast and overlooked ecosystem of pre-installed Android apps. My results show a complete lack of control of the supply chain which is worrying, given the huge potential impact of pre-installed apps on the privacy and security of end-users. I conclude with a number of open research questions and future avenues for further research in the ecosystem of the supply chain of Android devices.
Media coverage
-
This is how Android apps reveal our secrets without us being aware of itEl País (May 2023, also published in Spanish)
-
Los expertos apuntan a un error humano como probable causa del apagón de WhatsApp, Facebook e InstagramEl País (October 2021, also published in Portuguese)
-
My research was the basis of An open letter to GooglePrivacy International (January 2020, also published in French and in Spanish)
-
My research was mentioned in Mozilla Foundation's Internet Health ReportMozilla Foundation (August 2019, page 42)
-
Quién sabe que miras porno "online"El País (July 2019, also published in Portuguese)
-
Eggheads confirm: Rampant Android bloatware a privacy and security hellscapeThe Register (May 2019)
-
Software preinstalado en Android: la amenaza silenciosa que acecha al usuarioABC (Spain) (April 2019)
-
Google y los fabricantes no aclaran la vigilancia oculta en los moviles AndroidEl País (April 2019)
-
La collecte cachée des applications préinstallées sur AndroidLe Figaro (April 2019)
-
Android users' security and privacy at risk from shadowy ecosystem of pre-installed software, study warnsTechCrunch (March 2019)
-
Android apps gather user data without permissionThe Times (UK) (March 2019)
-
Android permite a empresas acceso indebido a datos personalesLa Vanguardia (March 2019)
-
Android ecosystem of pre-installed apps is a privacy and security messZDNet (March 2019)
-
Aplicaciones móviles que nos espíanRNE (Radio) - Todo Noticias (March 2019)
-
¿Sabes cómo tu móvil Android te espía?Cadena COPE (Radio) - Herrera en COPE (March 2019)
-
Ens espein a traves del mobil?TV3 (TV) - News (March 2019)
-
El móvil: Tu mejor y tu peor aliado te espía con aplicaciones que te instalan otrosTelecinco (TV) (March 2019)
-
Los móviles Android acceden de forma masiva a los datos personales de los usuarios sin su conocimientoRTVE (TV) (March 2019)
-
Un estudio revela vigilancia masiva por móvil con aplicaciones preinstaladasCadena COPE (Radio) (March 2019)
-
Los móviles Android acceden de forma masiva a los datos personales de los usuarios sin su conocimientoRTVE (TV) (March 2019)
-
Protección de Datos ve "riesgos para la privacidad" en los dispositivos AndroidPublico (March 2019)
-
Android permite que gran número de actores monitoricen y obtengan información personal de usuarios, según un estudioEuropaPress (March 2019)
-
Mòbils espies: la privacitat en riscTV3 (TV) - Els Matins (March 2019)
-
I spy: How Android phones keep tabs on our every moveEl País (March 2019, also published in Spanish)
-
Study Shows Limited Control Over Privacy Breaches by Pre-Installed Android AppsReuters (March 2019)