Name
Abstract | ||
|---|---|---|
The open-source nature of the Android OS makes it possible for manufacturers to ship custom versions of the OS along with a set of pre-installed apps, often for product differentiation. Some device vendors have recently come under scrutiny for potentially invasive private data collection practices and other potentially harmful or unwanted behavior of the preinstalled apps on their devices. Yet, the landscape of preinstalled software in Android has largely remained unexplored, particularly in terms of the security and privacy implications of such customizations. In this paper, we present the first large- scale study of pre-installed software on Android devices from more than 200 vendors. Our work relies on a large dataset of real-world Android firmware acquired worldwide using crowd-sourcing methods. This allows us to answer questions related to the stakeholders involved in the supply chain, from device manufacturers and mobile network operators to third- party organizations like advertising and tracking services, and social network platforms. Our study allows us to also uncover relationships between these actors, which seem to revolve primarily around advertising and data-driven services. Overall, the supply chain around Android's open source model lacks transparency and has facilitated potentially harmful behaviors and backdoored access to sensitive data and services without user consent or awareness. We conclude the paper with recommendations to improve transparency, attribution, and accountability in the Android ecosystem. |
Year | DOI | Venue |
|---|---|---|
2020 | 10.1109/SP40000.2020.00013 | 2020 IEEE Symposium on Security and Privacy (SP) |
Keywords | DocType | Volume |
pre-installed Android software,open-source nature,Android OS,product differentiation,device vendors,potentially invasive private data collection practices,potentially harmful behavior,unwanted behavior,preinstalled apps,preinstalled software,security,privacy implications,pre-installed software,Android devices,real-world Android firmware,crowd-sourcing methods,supply chain,device manufacturers,mobile network operators,tracking services,social network platforms,data-driven services,Android's open source model,sensitive data,Android ecosystem | Conference | abs/1905.02713 |
ISSN | ISBN | Citations |
1081-6011 | 978-1-7281-3498-7 | 1 |
PageRank | References | Authors |
0.35 | 0 | 5 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Julien Gamba | 1 | 18 | 2.18 |
| Mohammed Rashed | 2 | 1 | 0.69 |
| Abbas Razaghpanah | 3 | 68 | 6.86 |
| Juan E. Tapiador | 4 | 335 | 21.90 |
| Narseo Vallina-Rodriguez | 5 | 523 | 35.12 |