COVID-19 Mobile Applications: A Study of Trackers and Data Leaks
DOI:
https://doi.org/10.5753/jisa.2024.3882Keywords:
Mobile apps, data leaks, trackers, COVID-19Abstract
The emergence of COVID-19 in 2019 had a profound international impact. Technologically, governments and significant organizations responded by spearheading the development of mobile applications to aid citizens in navigating the challenges posed by the pandemic. While many of these applications proved successful in their intended purpose, the safeguarding of user privacy was not consistently prioritized, revealing a prevalent use of third-party libraries commonly referred to as trackers. In our comprehensive analysis encompassing 595 Android applications, we uncovered trackers in 402 of them, leading to the inadvertent exposure of sensitive user information and device data on external servers. Our investigation delved into the methodologies employed by these trackers to harvest and exfiltrate information. Furthermore, we examined the positions adopted by both trackers and governments. This study underscores the critical need for a reevaluation of the inclusion of trackers in applications of such sensitivity. Recognizing the potential lack of awareness within the scrutinized organizations regarding the risks associated with integrating third-party libraries, particularly trackers, we introduce SAPITO as part of our contributions. SAPITO is an open-source tool designed to identify potential leaks of sensitive data by third-party libraries in Android applications, providing a valuable resource for enhancing the security and privacy measures of mobile applications in the face of evolving technological challenges.
Downloads
References
AGESIC Uruguay (2020). Coronavirus uy. Available online [link]. Accessed: 2023-04-21.
Ahmed, Michelin, Xue, Ruj, Malaney, Kanhere, Seneviratne, Hu, Janicke, and Jha (2020). A survey of covid-19 contact tracing apps. IEEE Access, 8:134577-134601. DOI: 10.1109/ACCESS.2020.3010226.
Alfayez, Al-Sinayyid, and AL-Ameri (2021). Mobile applications developed by arab countries in response to covid-19: A review. Journal of Information System and Technology Management, 6:200-211. DOI: 10.35631/JISTM.622016.
Ali, ElFadl, Abujazar, Aziz, Abd-Alrazaq, Shah, Brahim, Belhaouari, Househ, and Alam (2020). Contact tracing apps for covid-19: Access permission and user adoption. In 2020 7th International Conference on Behavioural and Social Computing (BESC), pages 1-7. DOI: 10.1109/BESC51023.2020.9348327.
Allix, Bissyandé, Klein, and Le_Traon (2016). Androzoo: Collecting millions of android apps for the research community. In Proceedings of the 13th International Conference on Mining Software Repositories, MSR '16, pages 468-471, New York, NY, USA. ACM. DOI: 10.1145/2901739.2903508.
Android (2021). Instant apps. Available online [link] Accessed: 2023-04-21.
Android (2023). Notification permission. Available online [link] Accessed: 2023-05-01.
Anglemyer, Moore, Parker, Chambers, Grady, Chiu, Parry, Wilczynska, Flemyng, and Bero (2020). Digital contact tracing technologies in epidemics: a rapid review. Cochrane Database Syst Rev. DOI: 10.1002/14651858.CD013699.
AWO Agency (2020). Report on the privacy risks of covid-19 software. Available online [link].
AWO Agency (2021). Government responses to the covid-19 pandemic. Available online [link].
Azad, Arshad, Akmal, Riaz, Abdullah, Imran, and Ahmad (2020). A first look at privacy analysis of covid-19 contact-tracing mobile applications. IEEE Internet Things J. DOI: 10.1109/JIOT.2020.3024180.
Binns, Lyngs, Kleek, V., Zhao, Libert, and Shadbolt (2018). Third party tracking in the mobile ecosystem. In Proceedings of the 10th ACM Conference on Web Science, WebSci '18, page 23–31, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3201064.3201089.
Bock, Kühne, Mühlhoff, Ost, Pohle, and Rehak (2020). Data protection impact assessment for the corona app. SSRN Electronic Journal. DOI: 10.2139/ssrn.3588172.
Branch (2022). Branch privacy policy. Available online [link] Accessed: 2022-09-29.
Caputo, D., Pagano, F., Bottino, G., Verderame, L., and Merlo, A. (2022). You can't always get what you want: Towards user-controlled privacy on android. IEEE Transactions on Dependable and Secure Computing, pages 1-1. DOI: 10.1109/TDSC.2022.3146020.
CERN (2013). Zenodo. Available online [link] Accessed: 2022-09-20.
Cho, Ippolito, and Yu (2020). Contact tracing mobile apps for covid-19: Privacy considerations and related trade-offs. ArXiv, abs/2003.11511. DOI: 10.48550/arXiv.2003.11511.
Continella, A., Fratantonio, Y., Lindorfer, M., Puccetti, A., Zand, A., Kruegel, C., and Vigna, G. (2017). Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis. In Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS), San Diego, CA. Available online [link].
CovidSafeBE (2020). Covid safe privacy policy. Available online [link]. Accessed: 2022-09-30.
Dehaye and Reardon (2020). Proximity tracing in an ecosystem of surveillance capitalism. In Proceedings of the 19th Workshop on Privacy in the Electronic Society, WPES'20, page 191–203, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3411497.3420219.
Desnos (2022). Androguard. Available online [link]. Accessed: 2022-09-19.
Dieter, Helmond, Tkacz, Vlist, and Weltevrede (2021). Pandemic platform governance: Mapping the global ecosystem of covid-19 response apps. Internet Policy Review, 10. Available online [link].
Dubai Health Authority (2020). Covid19 - dxb smart app privacy policy. Available online [link]. Accessed: 2022-09-30.
European Data Protection Supervisor (2022). Privacy – a fundamental right. Available online [link]. Accessed: 2022-09-30.
European Parliament (2016). Gdpr. Available online [link]. Accessed: 2024-02-21.
Exodus (2022a). Exodus standalone. Available online [link]. Accessed: 2022-09-20.
Exodus (2022b). Exodus static analysis. Available online [link]. Accessed: 2022-09-19.
GetSocial (2022). Device fingerprinting. Available online [link]. Accessed: 2022-10-03.
Hatamian, Wairimu, Momen, and Fritsch (2021). A privacy and security analysis of early-deployed covid-19 contact tracing android apps. Empirical Softw. Engg., 26(3). DOI: 10.1007/s10664-020-09934-4.
He, Y., Yang, X., Hu, B., and Wang, W. (2019). Dynamic privacy leakage analysis of android third-party libraries. Journal of Information Security and Applications, 46:259-270. DOI: 10.1016/j.jisa.2019.03.014.
HSCNI Northern Ireland (2020a). Dpia covidcert. Available online [link]. Accessed: 2022-09-30.
HSCNI Northern Ireland (2020b). Dpia stopcovid ni. Available online [link]. Accessed: 2022-09-30.
HSE Ireland (2020). Dpia covid tracker app. Available online [link]. Accessed: 2022-09-30.
ICO United Kingdom (2020). Covid-19 contact tracing: data protection expectations on app development. Available online [link]. Accessed: 2022-10-04.
jadx (2022). jadx - dex to java decompiler. Available online [link]. Accessed: 2022-09-19.
Kollnig, Binns, Dewitte, Kleek, V., Wang, Omeiza, Webb, and Nigel (2021). A fait accompli? an empirical study into the absence of consent to third-party tracking in android apps. Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021). Available online [link].
Koronavirus app Croatia (2020). Dpia koronavirus. Available online [link]. Accessed: 2022-09-30.
Kouliaridis, Kambourakis, Chatzoglou, Geneiatakis, and Wang (2021). Dissecting contact tracing apps in the android platform. PLoS One. DOI: 10.1371/journal.pone.0258074.
Liu, Liu, Zhu, Wang, and Zhang (2020). Privacy risk analysis and mitigation of analytics libraries in the android ecosystem. IEEE Transactions on Mobile Computing, 19(5):1184-1199. DOI: 10.1109/TMC.2019.2903186.
MCIT Indonesia (2020). Pedulilindungi privacy policy. Available online [link]. Accessed: 2022-09-30.
MIT Technology Review (2020a). Covid tracing tracker. Available online [link]. Accessed: 2022-10-05.
MIT Technology Review (2020b). Mit technology review covid tracing tracker. Available online [link]. Accessed: 2022-10-03.
MoH New Zealand (2020). Dpia nz covid tracer. Available online [link]. Accessed: 2022-09-30.
MoH Turkey (2020). Hayat eve sigar privacy policy. Available online [link]. Accessed: 2022-09-30.
MoI Qatar (2020). Ehteraz privacy policy. Available online [link]. Accessed: 2022-09-30.
Nakamoto, Wang, Guo, and Zhuang (2020). A qr code–based contact tracing framework for sustainable containment of covid-19: Evaluation of an approach to assist the return to normal activity. JMIR Mhealth Uhealth. DOI: 10.2196/22321.
Nesmachnow and Iturriaga (2019). Cluster-uy: Collaborative scientific high performance computing in uruguay. In Torres, M. and Klapp, J., editors, Supercomputing, pages 188-202, Cham. Springer International Publishing. DOI: 10.1007/978-3-030-38043-4_16.
NHS United Kingdom (2020). Dpia nhs. Available online [link]. Accessed: 2022-09-30.
Perera and Hogben (2018). Capillary. Available online [link]. Accessed: 2022-10-02.
Pushwoosh (2019). Pushwoosh push notification privacy. Available online [link]. Accessed: 2022-09-24.
Razaghpanah, Nithyanand, Vallina-Rodriguez, Sundaresan, Allman, Kreibich, and Gill (2018). Apps, trackers, privacy, and regulators: A global study of the mobile tracking ecosystem. In NDSS. Available online [link].
Samhi, Allix, Bissyandé, and Klein (2021). A first look at android applications in google play related to covid-19. Empirical Software Engineering, 26. DOI: 10.1007/s10664-021-09943-x.
Serrano (2023). Sapito gitlab. Available online [link]. Accessed: 2023-11-21.
Serrano, Betarte, and Campo (2023a). Analyzed binaries. Available online [link]. Accessed: 2023-06-05.
Serrano, Betarte, and Campo (2023b). Analyzed policies. Available online [link]. Accessed: 2023-06-05.
Serrano, N., Betarte, G., and Campo, J. D. (2023c). Third-party trackers in covid-19 mobile applications can enable privacy leaks. In Proceedings of the 12th Latin-American Symposium on Dependable and Secure Computing, LADC '23, page 80–89, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3615366.3615426.
Startapp (2022). Startapp privacy policy. Available online [link]. Accessed: 2022-09-29.
Stevens, Gibler, Crussell, Erickson, and Chen (2012). Investigating user privacy in android ad libraries. Workshop on Mobile Security Technologies (MoST). Available online [link]. Accessed: 2022-09-29.
Tahaei and Vaniea (2021). "developers are responsible": What ad networks tell developers about privacy. In Extended Abstracts of the 2021 CHI Conference on Human Factors in Computing Systems, CHI EA '21, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3411763.3451805.
Tangari, Ikram, Ijaz, Kaafar, and Berkovsky (2021). Mobile health and privacy: Cross sectional study. BMJ, 373:n1248. DOI: 10.1136/bmj.n1248.
US Department of Health and Human Services (1996). Hipaa. Available online [link]. Accessed: 2024-02-21.
Wang, He, Wang, Xia, Li, Wu, Zhou, Luo, Sui, Guo, and Xu (2021a). Beyond the virus: A first look at coronavirus-themed mobile malware.
Wang, J., Xiao, Y., Wang, X., Nan, Y., Xing, L., Liao, X., Dong, J., Serrano, N., Lu, H., Wang, X., and Zhang, Y. (2021b). Understanding malicious cross-library data harvesting on android. In USENIX Security Symposium. Available online [link].
Wang, L., He, R., Wang, H., Xia, P., Li, Y., Wu, L., Zhou, Y., Luo, X., Sui, Y., Guo, Y., and Xu, G. (2021c). Beyond the virus: a first look at coronavirus-themed android malware. Empirical Software Engineering, 26(4). DOI: 10.1007/s10664-021-09974-4.
Wen, Zhao, Lin, Xuan, and Shroff (2020). A study of the privacy of covid-19 contact tracing apps. In Park, N., Sun, K., Foresti, S., Butler, K., and Saxena, N., editors, Security and Privacy in Communication Networks, Cham. Springer International Publishing. DOI: 10.1007/978-3-030-63086-7_17.
World Health Organization (2020). Coronavirus disease COVID-19. Available online [link]. Accessed: 2023-05-09.
Wu, Wu, Wang, Ling, and Yang (2016). Efficient fingerprinting-based android device identification with zero-permission identifiers. IEEE Access, 4:8073-8083. DOI: 10.1109/ACCESS.2016.2626395.
Yang, Heemsbergen, and Fordyce (2021). Comparative analysis of china’s health code, australia’s covidsafe and new zealand’s covid tracer surveillance apps: a new corona of public health governmentality? Media International Australia. DOI: 10.1177/1329878X20968277.
Zhou, Jia, Skinner, Yang, and Claude (2021). Lessons on mobile apps for covid-19 from china. Journal of Safety Science and Resilience, 2(2):40-49. DOI: 0.1016/j.jnlssr.2021.04.002.
