Many Android apps secretly sharing your personal data

September 30, 2010 By Laura Khalil

Research released today by three research institutions suggests that 50 percent of Android applications may be secretly sharing your information with advertisers.

Researchers from Duke University, Penn State University and Intel Labs developed a piece of software called TaintDroid, which has been able to detect and report when applications transmit private information to remote servers.

Of the 30 applications tested with TaintDroid, 15 were found to be sending private information to advertising servers without informing users. That information included a phone’s SIM card number, GPS location and phone number.

And these weren’t just any Android applications. Researchers used the thirty most popular applications across 22 categories which required Internet permission, along with permission to access location, camera, or audio data.

Users put their faith in application developers and the fact is that, “Android’s coarse grained access control provides insufficient protection against third-party applications seeking to collect sensitive data,” wrote the researchers involved in this study.

A Google representative has responded to the report, saying, “In all computing devices, desktop or mobile, users necessarily entrust at least some of their information to the developer of the application. Android has taken steps to inform users of this trust relationship and to limit the amount of trust a user must grant to any given application developer. We also provide developers with best practices about how to handle user data.”

This doesn’t leave users with many options. Sure, you can try to put faith in application developers, but the fact is that until stricter security standards are put in place, many Android applications may continue sharing your data.

Showing 19 comments

RockinRobin at 8:31pm 17th October 2010 I think you mean "a sample size of 30 would give you a MARGIN OF ERROR of 18% at a confidence level of 95%," etc. In fact, I'm certain.
frank at 4:46am 16th October 2010 every smartphone does this. including apples iphone
Paul at 3:31pm 15th October 2010 'A Google representative has responded to the report, saying, “In all computing devices, desktop or mobile, users necessarily entrust at least some of their information to the developer of the application."' Pure BS! There is NO reason for an app like, say, Word to be communicating any of my data to anyone.
Dave at 3:47pm 1st October 2010 The problem lies more in the advertiser's lap. They require this information in order to supply your app with banners. Most of it is localisation data for geo targeted adverts. If you want free apps this is something that you have to expect as developers appreciate some income for their hard work. I expect the situation is also the same on the iphone.
InternetBeacon.com at 11:15am 1st October 2010 This is the price we pay for an open marketplace. I'm not condoning this action, just saying that consumers are responsible considering the central authority for apps is much more accepting of programs. Unfortunately, this is the downside of open source, people who abuse it.
Ugrashrath at 9:52am 1st October 2010 While this might be true, there's a lot of vagueness. They don't tell you which apps and which categories these apps come from. Since it's 30 apps from 22 categories, that's about 1 per category, with some having 2. It doesn't mean is has to be the number one most popular app in that category. For all we know, they specifically targeted apps which may do this, and only published the results of this, making it seem like there's a much higher percent of apps doing it than in reality. Regardless, when you go to the market and install these apps, they all ask for permission to do certain things. Most people don't read it, and just click okay. If you don't want your information out there, then don't use the apps, or at least, use a program that will protect it. A lot of the popular Apps are free as well, the developer has to be making money on it somehow, or the app wouldn't be getting updated.
yogi at 8:04am 1st October 2010 Man this is like the CFA lesson I took this week Hypothesis Testing lolz.... this made my "fundas" all clear
Lou at 3:37am 1st October 2010 Just buy the iphone
1. Hans at 3:57am 1st October 2010 Really Lou? Because Apple won't collect your info? The problem is, these developers also write apps for the iPhone and share mostly the same info. Recently, Apple came under fire for semi-secretly collecting and sharing GPS-information for location based advertising. Did they fix it? No, the changed the EULA a little, which by the way already mentioned the issue for a few years. (who reads them anyway?) Let's face it, our privacy is not compatible with technology. If you don't like it, don't use a computer or smartphone.
2. lololol at 10:02am 1st October 2010 u forgot the sarcasm tags <sarcasm> just buy the iphone </sarcasm> fixed we can go about our day now.
Craig Chamberlin at 12:34pm 30th September 2010 I don't understand why they don't give the names of the applications. I'd like to see what I've been using in the top categories that are sending me information. This article seems to just be a paranoia driver. In other words, some apps tested bad with information, therefore you shouldn't trust any of them. How about giving us some insight as to how we can track and protect ourselves from these privacy invasions?
1. @BradleyF81 at 10:52pm 1st October 2010 If they gave the names of the apps, then someone could prove that this isn't a good representation, or possibly an outright lie for attention.
SteveIsMyiConArtist at 11:52am 30th September 2010 This "news article" brought to you by the crApple marketing department and their bribed cronies in the media.
bootcamp2010 at 11:52am 30th September 2010 Read the article, "Researchers used the thirty most popular applications across 22 categories which required Internet permission, along with permission to access location, camera, or audio data." The most popular applications were doing this, no reason to believe that less popular apps are behaving any diffferently. One day you might crave the refuge of that that walled garden.
Jeff at 11:50am 30th September 2010 Checking 30 apps out of the thousands once could install is hardly a reasonable spread. Test a couple hundred and see where the ratio is then. Not that I doubt that the amount of apps sending personal data would be significant, but with such a small number of apps tested, this article is misleading and sensationalist at best.
1. @tonicboy at 3:59am 1st October 2010 With a population of approximately 100,000 apps, a sample size of 30 would give you a confidence interval of 18% at a confidence level of 95% (the typical confidence level used in polls). In other words, we can be 95% confident that the true ratio is between 32-68%. As far as I'm concerned, any result in that range is alarming and hardly sensationalist. However, their selection method is flawed because it isn't random. There could easily be a hidden factor affecting the ratio for popular apps. For example, developers could be under greater pressure to sell private data for popular apps because their data is more valuable. However, it's hardly a result to dismiss.
DCRocks at 11:43am 30th September 2010 just get an app like Droid wall and block all net access to the apps. Problem solved.
1. phatcatz at 10:22am 1st October 2010 What if those apps share data?
drksilenc at 11:40am 30th September 2010 lol ok what were the 30 applications tested. it takes a little more than a dim lightbulb to be able to determine what apps are safe and which ones are bad. sry this isnt apple in the walled garden.