Research team analyzed One of the features of the Android operating system, which may pose a threat to user privacy. As the results of the study showed, a large number of popular Android applications today use the Installed Application Methods (IAM) – a set of Android API calls that allow application developers to get a list of other applications installed on the device.
Initially, these calls allowed developers to detect application incompatibilities or to configure interaction with other programs. But scientists said that IAM is also used to track and identify users, creating privacy risks.
A team of four scientists from universities in Switzerland, Italy and the Netherlands analyzed thousands of applications for Android devices and their code for AIM calls. Researchers analyzed 14,342 popular Android apps on the Google Play Store, as well as 7,886 Android apps whose source code was published on the Web. According to the research team, the use of IAM is quite common in commercial applications: 30.29% (4,214) of applications on the Play Store make IAM calls in their code. For open source applications, this number was only 2.89% (228 applications).
Опасность для конфиденциальности пользователей связана с тем, что рекламодатель может определить интересы и личные качества (сведения о поле, известных языках, религиозных убеждениях и возрасте) путем анализа списка установленных приложений пользователя. Кроме того, пользователи не могут защитить себя от отслеживания цифрового отпечатка браузера на основе IAM, поскольку приложению не нужно запрашивать разрешение у пользователя для осуществления данных вызовов. Кроме того, многие вызовы IAM также выполняются без ведома разработчика приложения.
As experts noted, almost half of all recorded IAM calls, both in the Play Store and in open source applications, were associated with packageName, which retrieves a list of locally installed applications. Others were used to obtain technical information about the application, such as signatures, program versions, last update time, or SDK version numbers.
According to experts, most IAM calls came from third-party libraries added to applications, and not from the programs themselves. More than a third of third-party libraries were used for advertising purposes.
According to a survey of 70 application developers, many did not even know about making IAM calls by third-party libraries.
The research team calls on Google to limit the use of IAM calls. According to experts, Google needs to establish permission requests to make these calls.