Mobile devices and applications are no longer an accessory – they’re central to our daily lives. Gartner predicts the number of mobile apps downloaded will double to 45 billion this year – and they’re only getting smarter. Today’s apps are increasingly essential to accessing critical business applications, connecting with friends on the go and even adopting digital wallets.
While these apps make our lives easier, they also give a wider group of application developers and advertising networks the ability to collect information about our activities and leverage the functionality of our devices. At the same time, the companies, consumers and government employees who install these apps often do not understand with who and how they are sharing personal information. Even though a list of permissions is presented when installing an app, most people don’t understand what they are agreeing to or have the proper information needed to make educated decisions about which apps to trust.
More concerning is that many apps collect information or require permissions unnecessary for the described functionality of the apps. This is not the first time this issue has surfaced – reports of popular apps collecting irrelevant information or transmitting data when devices are turned off has led to significant backlash. However, less is known about the state of privacy across the entire application ecosystem.
To get a sense of the state of application privacy today, Juniper Networks’ Mobile Threat Center (MTC) analyzed over 1.7 million apps on the Google Play market from March 2011 to September 2012.
We found a significant number of applications contain permissions and capabilities that could expose sensitive data or access device functionality that they might not need. We also determined these apps had permission to access the Internet, which could provide a means for exposed data to be transmitted from the device. Of particular interest, free applications were much more likely to access personal information than paid applications. Specifically, free apps are 401 percent more likely to track location and 314 percent more likely to access user address books than their paid counterparts.
24.14 percent of free apps have permission to track user location, while only 6.01 percent of paid apps have this ability;
6.72 percent of free apps have permission to access user address books, while 2.14 percent of paid apps do;
2.64 percent of free apps have permission to silently send text messages, whereas 1.45 percent of paid apps can;
6.39 percent of free apps have permission to clandestinely initiate calls in the background, while only 1.88 percent of paid apps do; and
5.53 percent of free apps have permission to access the device camera, whereas only 2.11 percent of paid apps have this access.
When looking at the disparity between free versus paid apps, there is a common industry assumption that free apps collect information in order to serve ads from third-party ad networks. While this is true in some cases, Juniper examined 683,238 application manifests and found the percentage of apps with the top five ad networks is much less than the total number tracking location (24.14 percent).
0.75 percent of apps feature AdMob ads;
4.10 percent of apps feature ads from the AirPush network;
1.51 percent of apps include Millennial Media ads;
0.32 percent of apps include ads from AdWhirl; and
2.34 percent of apps feature ads from the Leadbolt ad network.
This leads us to believe there are several apps collecting information for reasons less apparent than advertising.
Potential for Misuse of Permissions
Possibly more concerning are the other permissions being requested from applications like the ability to clandestinely initiate outgoing calls, send SMS messages and use a device camera. An application that can clandestinely initiate a phone call could be used to silently listen to ambient conversations within hearing distance of a mobile device. Similarly, access to the device camera could enable a third party to obtain video and pictures of the area where the device is present, as was recently presented with the proof-of-concept Spyware PlaceRaider.
Silently sending SMS messages can also be a means to create a covert channel for siphoning sensitive information from a device. Further, the potential for stealth SMS messages or calls can have monetary repercussions by communicating with services that will subsequently charge a fee, such as calling a 1-900 in the U.S. or sending premium SMS messages.
Apps Categories of Most Concern
The Juniper MTC also looked at different categories of applications and found some that seemed to be comparatively overstepping the needs of the applications when accessing certain permissions. For these apps, we cross-referenced the permissions requested with the functionality in the description of the apps. Our analysis noted apps that had the ability to do well more than a user could know and collect information not documented as necessary for the app to perform its intended use.
Racing Games are by far the most concerning category with an abnormally high number of apps removed from the marketplace over the time period of our analysis. Applications can be removed for a variety of reasons, including Google doing so for concerns over malware, questionable developers temporarily placing apps to phish for data, or for legitimate reasons, whereby an application is simply no longer being offered by a developer. During the manual portion of the research, this category contained the highest number of applications that the MTC would consider to be newly discovered malware.
99 percent of paid apps and 92.42 percent of free apps in this category have permission to send SMS messages and did not provide an explanation of why this capability would be necessary in the game;
50 percent of free apps that have permission to use the camera do so without any description of how or why this capability is being used; and
94.54 percent of free apps with the ability of initiating outgoing calls did so without providing any description or justification for why this capability is necessary.
Upon Further Review
Our research also led to some unexpected insights as to the legitimate use of permissions. We examined cases where permissions or data collection was justified even though the reasons were not immediately obvious. We did this by installing apps to fully understand their functionality, as well as contacting several developers.
There were a number of Cards and Casino apps from a specific developer that had the ability to use the device camera functionality. In reading the app descriptions and installing the application, there did not appear to be any reason for this capability. We contacted the developer who explained that with the premium version of the app, an icon would appear in the Tool Bar to enable the user to take a picture to use as a background for the game. This is a legitimate logical use that was not clearly communicated upfront for a consumer to understand or appreciate.
During our initial analysis of outgoing call permissions, it seemed concerning that 12.51 percent of free Finance apps had the ability to initiate a phone call without going through the dialer interface and that 63.19 percent didn’t provide a description of this capability within the app. However, after installing a number of these applications, it became clear that this capability was legitimately used by users to contact local financial institutions.
The MTC’s analysis of the Google Play market shows the pervasiveness of mobile tracking and where apps could do a better job of disclosing why they need information up front and highlight functionality as a genuine user benefit. Our hope is that this research can give a better understanding of the current state of application privacy and provide insight to ensure the best actionable information is available to understand the effects on user privacy and the protection of enterprise data. We have several suggestions that the industry should consider:
Correlate permissions to actual app functionality. Simply saying an app has the permission to track location, read contacts or silently perform an outgoing call doesn’t provide the necessary context of why this functionality is necessary for a specific app. Providing a means to communicate how permissions align with how the app works would help address this item.
Better differentiate between permissions. There is a big difference between a Spyware app clandestinely placing an outgoing call to listen to ambient conversations within hearing distance of the device, and a financial app that provides the convenience of calling local branches from within an application. The manner in which permissions are currently presented does not provide a means for users to differentiate between the two. More needs to be done to provide developers with differentiated permissions and to perform these very different actions.
Accept some exposure with free apps. It seems there is no such thing as a free lunch in mobile. If people choose to use free applications, they will likely need to provide information in exchange. Often times, the value provided by the app is well worth the information given up by a user; however, many do not realize that this tracking is happening and may not be making informed choices. Communicating why information is needed in a concise and easy-to-understand means could help people become more comfortable with information sharing.
A smaller amount of actionable data is beneficial. Helping people understand what is actually occurring on their device and with their data has considerably more value than a list of permissions. More educated users means they are more comfortable installing apps and less likely to uninstall once they see the number of permissions being requested without explanation.
The research contained in this report was conducted on the Google Play market. Apple does not disclose related information about its apps, and questions regarding the Apple App Store and related privacy statistics should be directed towards Apple.
This research was conducted via four primary means:
Statistical analysis of application meta-data to determine permissions being requested by paid and free apps in various application categories;
Analysis of application descriptions to determine if the reasoning behind permission usage is being explained and justified by application features and functionality;
Statistical analysis of application manifests to correlate permissions being requested to AdNet usage; and
Manual installation and research of applications to further explore key findings and to verify study methodology.
Title: Senior Vice President and General Manager of the Branch Solutions Business Unit
Area of Responsibility: Driving Juniper business including strategy, revenue/profitability, products and execution for this segment of SLT's overall portfolio, specifically comprehensive solutions for the small to medium size locations of large, distributed enterprises.
Alex joined Juniper in February 2008 after more than five years at Extreme Networks, where he served as Chief Operating Officer from mid 2002 through 2006, and the last year as VP and GM of Extreme's high-end switching business and core engineering operations. During his tenure at Extreme Alex led programs which established essential product lifecycle and quality systems, completely refreshed the product portfolio, significantly improved product and service quality and margins, and streamlined the supply chain.
Prior to Extreme Alex served as Chief Operating Officer for LCG Wireless (acquired by ADC Telecommunications), SVP Business Operations for ReplayTV, and earlier spent eight years in various executive roles with Octel Communications (acquired by Lucent Technologies) as CIO, SVP Business Operations, and SVP and GM of Enterprise Messaging. Alex holds a bachelors and masters degree in electrical engineering from Washington University in St. Louis.
Bill is the Director of Federal Certifications and Policy at Juniper Networks. In this role, Bill focuses on several areas unique to the needs of Federal Government customers, including product certifications, IPv6, and security. Bill came to Juniper Networks in January 2008 after more than 20 years in the IT community working with commercial enterprise customers, service providers, and the US Federal Government.
Bill started his career as an engineering officer in the US Air Force after graduating with a Bachelor of Aerospace Engineering from the Georgia Institute of Technology. Bill has an MBA from the Wharton School at the University of Pennsylvania.
Brad Minnis, CPP is the Senior Director of Corporate Environmental, Health, Safety & Security for Juniper Networks, Inc. based in Sunnyvale, CA, where he is responsible for strategic design, implementation and management of the company’s security, safety, environment, crisis management and business continuity functions. He also leads the company’s efforts in corporate citizenship and sustainability, and manages the Corporation’s government-related security programs.
Mr. Minnis has over 30 years experience in the Silicon Valley and has managed EHSS operations for a number of high tech companies, including Juniper Networks, 3Com Corporation, and National Semiconductor Corporation.
Mr. Minnis’ specialties include security management, supply chain and product integrity, anti-counterfeit, occupational health and safety and crisis management. In his role as Cyber Incident Response Team Leader for Juniper, Mr. Minnis has managed numerous high impact cyber-related incidents and cross-functional responses.
Mr. Minnis served for ten years in the United States Navy and has served in leadership positions the International Security Management Association (ISMA) and ASIS International, serving as Chairman of the San Francisco Chapter in 2003. He has also co-written several publications on software integrity assurance and supply chain security with organizations such as SAFECode.
Mr. Minnis is certified as a Protection Professional by the Professional Certification Board of ASIS International and attended the University of Connecticut, where he received two certificates in Environmental, Health and Safety
François Prowse is a Senior Systems Engineer for Juniper Networks, based in Brisbane Australia. Francois joined Juniper in 2006 as part of the New Zealand SE team, subsequently relocating to Australia. Prior to Juniper, Francois worked for four years at Alcatel in both operational and architectural roles, being jointly responsible for the construction of New Zealands' largest MPLS core network. Prior to Alcatel, Francois worked at UUnet, focusing on core network expansion in Europe. In all previous roles JUNOS has been the driving factor behind day to day operations, providing him with over 8 years of operational experience. Francois is a Juniper Networks Certified Internet Expert (JNCIE #144) which he obtained prior to joining Juniper Networks.
Greg Sidebottom is a Senior Engineering Manager in the Identity and Policy Management business unit at Juniper Networks. Greg has spent the last decade plus conceptualizing, architecting, designing, and leading the implementation of Juniper's SDX and SRC families of policy based service management applications. Previous to this, Greg held positions in the software and networking industries at Siemens, Cognos, Nortel, GTE labs subsidiary MPR Teltech, and the Alberta Research Council. Greg is an author of eight invention disclosures resulting in two patents issued and three pending. Greg holds a B.Sc. in Computer Science for the University of Calgary and an M.Sc. and Ph.D. in Computing Science from Simon Fraser University.
Senior Product Line Manager – CTP Products Juniper Networks.
Jim Kelly is the senior product line manager for the CTP products where he is responsible for the CTP product direction, marketing and circuit emulation applications within Juniper Networks. Mr. Kelly has more than 28 years of experience in the networking industry in technical roles, sales, marketing, and product management positions. He started his career in the United States Air Force. He has worked for Wang, Digital Telecom Systems, American Airlines, Network Equipment Technologies, Carrier Access, and Nortel Networks. He started Juniper Networks federal DoD sales in July 2000 and joined Juniper Networks again in October 2005 through the acquisition of Acorn Packet Solutions where he was the director of sales and marketing.
Justin Ryburn is a Senior Systems Engineer at Juniper Networks. He holds an MBA and a MS in IT Management from Webster University as well as numerous industry certifications. Justin contributed content for Cyber Forensics (Auerbach Publishing, 2007) and spoke on BGP Flowspec at NANOG63. Prior to joining Juniper, Justin held various operations, engineering, and sales engineering positions over his 15-year career with companies such Savvis, Nortel, XO, and Charter.
I am currently a Sr. Product Marketing Manager specializing in Juniper's Security Portfolio in the Service Provider industry. I am an experienced senior technical leader, technical marketing engineer, solutions architect, and product marketing manager with over 20 years of Internet and Enterprise industry experience developing solutions from scratch often in relation with business units and technology groups, my projects ranged from product, solution, and technology development to corporate technology strategies. I have strong analytical skills and I am able to crunch and articulate complex technology to a variety of audience knowledge levels. I possess a deep hands-on technology and business knowledge of Service Provider and Enterprise architectures with deployment hands-on skills. I also bring a unique perspective of open source philosophy, including but not limited to open innovation, software development methodologies, open source monetization and business models, and licensing and compliance in software integration. I am a strategic leader with proved ability to empower a team to improve their product, themselves, their team, and our company’s market position.
30 Years in Book Publishing, 20 years in Technical Book Publishing, including Apple Developer Press, Adobe Press, Nokia Developer Books, Palm Books, and since 2001, almost 10 years as consulting editor/editor in chief for Juniper Networks Book. Joined the company and started the Day One book line and in 2011, the new This Week book line.
Rajoo Nagar is a senior manager in product marketing at Juniper Networks. She is responsible for product marketing for Juniper's security solutions. Rajoo is a published author, her book “Telecom Service Rollouts” was published by McGraw Hill Professional.
I'm a Product Line Manager in the Security Business Unit working on all things intrusion prevention-related. I've been in the security field since 1994 working on diverse projects such as developing HP's public-key infrastructure (PKI), building the first protocol anomaly-based IDS at Recourse Technologies (acquired by Symantec), integrating vulnerability management and IDS at VM vendor nCircle and managing IPS products at Cisco and Juniper.
Jonathan Looney is a Senior Staff Courseware Developer at Juniper Networks. Before joining Juniper, he performed network engineering for a large enterprise, a regional ISP, and an application service provider (ASP). The holder of several industry certifications, he enjoys the freedom his job at Juniper gives him to both continually learn and also to share his knowledge with others through a wide range of media.
Scott is the Director of Product Marketing for Mobile Security at Juniper Networks. In his 20+ years in high tech, Scott has worked on Mobile and Endpoint Security, Network Security, IPS, Managed Services, Network Infrastructure, Co-location, Microprocessor Architecture, Unix Servers and Network Adapters. He has held leadership roles at Check Point, McAfee, Symantec, Exodus Communications, Cable & Wireless, Savvis, and HP.
Sherry Ryan is IT Vice President and CISO of Juniper Networks. Previously, Sherry held similar positions at Blue Shield of California, Hewlett-Packard, Safeway and Levi Strauss where she established and led their information security programs. Sherry holds the Certified Information Security Manager (CISM) certification from ISACA and the Certified Information Systems Security Professional (CISSP) certification from ISC2. She is a member of the High Tech Crime Investigation Association (HTCIA) and the Information Systems Security Association (ISSA).
Sherry has a bachelor's degree in Business Administration from the University of Redlands, and earned her MBA from the College of Notre Dame.