[No More News] Android Platform is Facing Privacy Leaking Issue

[This piece of article is unstable]

I guess most of the Android users are interrupted by advertisements almost everyday. For me, as a two-year Android user, downloading apps from Google Play Store is my daily task. Some apps really make my life better, some of them, errrr, on the opposite, annoying me by continuously sending trash message. However, there is no best method than uninstalling these quirky apps unless Android platform empowers us more rights on  granting Apps ad-hoc roles. (But definitely,  it would increase the complexity of an OS) Frankly, I'm also worried about whether it is appropriate to allow some apps get acknowledged of my location. It would be risky that apps send my private data (i.e., location, call status) without any notification.

(Currently, Android platform only allows install-time permissions, which means the only opportunity to deny app's access to use's privacy is when it is installed)

In response to this issue, researchers have made some progresses. One direction is using information flow analysis to monitor the binary code of these apps and then notify mobile phone owners when it intends to send out sensitive data. The most influential work is done by TaintDroid guys. (Have a look at their website http://appanalysis.org/). In fact, I would love to have more discussion with you on this issue, so this piece of article might be updated continuously. 

To begin with this issue, we have to know several possibilities that apps leak user's privacy. Specifically, on earth what kind of Android APIs are likely to "show" the way to user's backdoor. Available methods that send out user's data are listed below:

1. SMS Communication 

function: endTextMessage(String destinationAddress, ... , String text, ...)

2. File Output

function: FileOutputStream(String path)

3. Network communication

function: Socket(String destiniationName, int destinationPort)

4.Intents

Android applications can send Intent objects containing data to other components. The class Context contains the methodsstartActivity,startService, andsendBroadcastwhich can be used to activate other components of the same or different apps. Each of these methods expects an Intent object as the single parameter. It can contain arbitrary data which is transmitted to the activated component.

5.Content Resolver

function: update(Uri uri, ContentValues values, ...)

insert(Uri uri, ContentValues values)