We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Intelligent Machines

Android Ads Could Attack, Study Warns

Ad libraries, bundled with free apps, could sniff data and even install malicious software.

To guard against malicious behavior, apps that run on Android smart phones must ask politely for permission to do things like access your personal information, track your location, or transmit data via the Internet. But once they have approval, these apps can share the permissions with the advertising libraries they use to serve up ads, creating serious potential privacy and security vulnerabilities, researchers have found.

Trap Door: This permission screen—typical for a free Android app—also grants the same permissions to the app’s ad libraries.

Combing through 100,000 apps selected randomly from Google Play (the erstwhile Android Market), a team of researchers at North Carolina State University found that 48,139 of the ad libraries used by these apps tracked the user’s GPS location; 18,575 tracked the identity of the phone (its IMEI number); 4,190 let advertisers track the user via GPS; and 4,047 accessed the device’s phone number.

Dozens of such “ad libraries” exist, generating onscreen ads with the associated apps. When you click on an ad, the app maker gets a fee. One of these libraries, called energysource, uses an insecure method of loading code from the Internet, says Xuxian Jiang, the North Carolina professor who led the study, released as a paper to be presented at a conference in Tucson next month. Though the researchers did not detect malicious behavior from the app, they did say it poses a security threat simply by allowing code to be downloaded and run.

Of the 100,000 apps, 297 contained ad code that allowed the phone to run code downloaded from the Internet, providing a potential path for malicious software to get inside the device. “If your app has permission to access personal information, the ad library also has permission to access your information,” Jiang says.

The North Carolina research is only the latest evidence of gaping security and privacy holes in smart phones. In April of last year, iPhones and Android devices were found to track users’ locations automatically. Then, in December, these and other smart-phone devices were found to carry diagnostic software that also tracks a wide range of user information. More recently, it was discovered that both iPhones and Android devices share users’ address books and other information with apps. And instances of mobile malware have been rising.

The new findings point to a flaw in the business model behind apps, Jiang says. Developers rely on revenue from ad libraries to support free apps, but they have no control over what those libraries do. “The current model of embedding ad libraries in mobile apps for monetization purposes poses security and privacy risks. These ad libraries will essentially have the same set of permissions granted to the apps that enclose them. And certain ad libraries may abuse them for other unwanted purposes.”

Mobile device makers should provide ways to isolate the two, Jiang says, so that the ads run separately from the host apps—and require separate explicit permissions. “There are fundamental concerns in the way mobile apps are being monetized,” he adds.

Adding insult to injury, other research has recently found that ads associated with free Android apps are also battery-drainers. Abhinav Pathak, a computer scientist at Purdue University, and colleagues at Microsoft Research found that as much as three-quarters of the juice used by such apps is spent to serve ads and transmit user data back to advertisers.

Keep up with the latest in security at EmTech MIT.
Discover where tech, business, and culture converge.

September 11-14, 2018
MIT Media Lab

Register now
More from Intelligent Machines

Artificial intelligence and robots are transforming how we work and live.

Want more award-winning journalism? Subscribe to Insider Online Only.
  • Insider Online Only {! insider.prices.online !}*

    {! insider.display.menuOptionsLabel !}

    Unlimited online access including articles and video, plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.