Hey, You, Get off My Private Data: Do Apps Respect Your Privacy as They Claim?
summary
Framework that auto-audits Android apps for real data flows and regulatory gaps, with four tools: domain reputation checks, an API scanner, network-traffic capture, and a hook that detects pre-consent data access. Implementation shows static-field hooking to log accesses (e.g., device serial) and writes traces to SD card in a demo. Tested roughly 1,000 apps across stores and flags hundreds (example: 579) that read private info via non‑permission or bypass methods, exposing gaps with GDPR/Google Play rules.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 3:08Data collection risks
- 6:07Regulatory implications
- 9:07Data protection principles
- 12:21Privacy policy requirements
- 16:26Framework proposal
- 23:23Auditing tools and techniques
- 28:52Data collection demo
- 32:38Test results and findings
- 34:30Conclusion and recommendations
related talks
25mThe State of Mobile App Privacy: Compliance Trends & Takeaways
36mRevisiting Stealthy Sensitive Information Collection from Android Apps
38mDeveloping Mobile Apps with Privacy as a Baseline Need
28mEmbracing innovation by building privacy friendly apps
17mMeasuring Privacy Risks in Mobile Apps at Scale
21mDeveloping privacy user-centric apps
20mDemystifying the Android Telehealth Ecosystem
24mModern Android App Security: Protecting Code, Keys, and Data