Source-linked AI summary
Longitudinal Analysis of Android Ad Library Permissions
Theodore Book, Adam Pridgen, Dan S. Wallach
TL;DR
The paper asks how Android ad-library permission use changes over time, addressing prior research that mainly captured the ecosystem at a single point. It identifies and dates libraries from application releases, then maps permissions in their code. Most permissions increase over time, including permissions associated with privacy risks and user identification.
Problem
Prior studies documented ad libraries’ ability to access sensitive data but focused on the ecosystem at a single point in time.
Method
The study identifies ad libraries in Android applications, estimates library-version release dates from the earliest applications using them, and maps permissions from disassembled library code.
Results
Most permissions show increasing use over time, with growth especially visible for permissions associated with device and user identification and other privacy risks.
Takeaways & Limitations
The growth of dangerous permission capabilities in ad libraries warrants particular scrutiny and highlights the importance of privacy-protective community norms.
Abstract
from arXiv · showhide
This paper investigates changes over time in the behavior of Android ad libraries. Taking a sample of 100,000 apps, we extract and classify the ad libraries. By considering the release dates of the applications that use a specific ad library version, we estimate the release date for the library, and thus build a chronological map of the permissions used by various ad libraries over time. We find that the use of most permissions has increased over the last several years, and that more libraries are able to use permissions that pose particular risks to user privacy and security.
I. INTRODUCTION
Android ad libraries share their host applications’ permissions, creating a platform for studying how advertising-related access to system capabilities changes over time. The paper addresses the limitation of prior point-in-time studies using a large application sample, library identification, release-date estimation, and permission mapping.
- Android permissions: Android applications request privileges through manifests, and users generally accept all requested permissions or do not install the app.The permission system regulates access to Android API calls, including access to device identifiers through READ PHONE STATE.
- Android permissions: Ad libraries share their host applications’ privileges and can probe for or require permissions to function.This makes permissions available to the library even when the host application requested them.
- Research goals: Prior studies documented ad-library access to sensitive data but largely examined the ecosystem at a single point in time.This paper instead studies changes in library permission usage over time.
- Method overview: The study sampled popular free applications from Google Play, identified ad libraries, dated library versions using the earliest application release containing each version, and mapped permission use from disassembled code.The dataset began with 114,000 downloaded applications; 68 ad-library package names were manually identified before automatic matching.
- Method limitations: The methodology can under-measure permission usage when library code is omitted and can reduce dating accuracy when one release fragments into multiple versions.Static analysis also misses API calls invoked through reflection, while library-version dating is treated as less precise for libraries appearing in fewer applications.
III. ANALYSIS
The analysis maps changes in ad-library permission usage over time after identifying and dating library versions and mapping their permissions.
- Analysis: The study combines identified library names and versions, estimated release dates, and permission mappings to analyze changes in permission usage over time.The resulting analyses are derived from the dated library-permission data.
A. Permission Usage by Library
Ad libraries varied substantially in the number of permissions they could use, with one library reaching 15 and the average reaching 3.3.
- Permission usage by library: 15 permissions was the maximum any library was able to use, reached by some versions of MobClix.The listed permissions included network, location, device-state, contact, account, and other capabilities.
- Permission usage by library: 3.3 permissions was the average number an ad library was able to use.The minimum was one permission, and INTERNET was required by all libraries.
B. Permission Usage over Time
The paper examines how many libraries could use individual permissions and how those percentages changed over time, with most permissions—including dangerous ones—showing increasing trends. These capabilities include basic ad delivery, connectivity and device identification, and access to other potentially sensitive information.
- Permission counts: Figure 2 counts libraries capable of using the seven most common permissions, while grouping less common potentially dangerous permissions into one category.A library enters the dangerous category when it uses one or more permissions classified as potentially dangerous.
- Interpretation: An ad library’s ability to use a permission does not establish that the permission was abused.Some permissions may have legitimate uses with appropriate user confirmation, although their abuse potential warrants scrutiny.
- Permission percentages: Most permissions, including dangerous permissions, show an increasing percentage trend over time.Figure 3 includes months with data on at least five libraries, with later months becoming more precise as more libraries were measured.
- Permission roles: The INTERNET permission supports downloading and displaying advertisements, while ACCESS NETWORK STATE supports calls that can determine the network connection used for requests.The analysis links these permissions to the basic communication functions of ad libraries.
- Sensitive capabilities: READ PHONE STATE can retrieve a device ID, ACCESS WIFI STATE may obtain a MAC address, and account access can expose an account name such as an email address.These capabilities can provide identifiers associated with the device or user.
C. Library Market Share
The analysis weights ad-library permissions by library popularity to estimate exposure on a typical device. A small group dominates installs, but many libraries retain substantial market presence and the estimates have important sampling limits.
- Library popularity is measured by both the number of apps using a library and cumulative installs across those apps.
- The top 10 libraries account for 71% of all measured installs.
- Install counts use conservative low-end estimates and may be up to five times smaller than actual counts.
- The sample emphasizes popular apps, so library distributions among less popular apps may differ.
- The top 25 libraries have approximately 90% market share, while the top 33 have 95%.
- The security of user data and devices depends on the behavior of many ad-library principals because dozens have significant market share.
D. Install Weighted Permission Usage
Install-weighted analysis estimates which permissions are accessible to ad libraries on a typical device. Dangerous-permission use generally increases over time, while specific permission trends reflect library and API changes.
- Install Weighted Permission Usage: ACCESS FINE LOCATION is more common in install-weighted data, with a significant mid-2012 drop after an AdMob API call was removed.
- Install Weighted Permission Usage: Dangerous permissions are somewhat less common because the largest ad libraries do not use them.
- Install Weighted Permission Usage: READ PHONE STATE and ACCESS WIFI STATE are somewhat less common among permissions used to generate unique tracking identifiers.
- Dangerous Permissions: Dangerous-permission prevalence shows a generally increasing trend, although the data is noisy because relatively few libraries use these permissions.
- Dangerous Permissions: GET TASKS can reveal running or recently used processes and, with package information, identify installed and regularly used apps.
- Dangerous Permissions: Contacts-related permissions can expose information about a user’s contacts, while GET ACCOUNTS can expose account names such as email addresses.
- Dangerous Permissions: Some libraries use CAMERA and RECORD AUDIO to support ad interactions involving photographs or audio recording.
F. Comparison With Other Datasets
A comparison with a 2011 dataset found substantially similar permission-use estimates, supporting the inferred longitudinal pattern. Across the study period, permission use generally increased, especially for data collection and dangerous permissions, while location permissions declined.
- Cross-dataset validation: The 2011 comparison dataset produced permission-use estimates substantially similar to the values inferred for May 2011.The comparison used 5,000 Android apps retrieved in May 2011 and identified 3,374 ad libraries.
- Permission growth: The average ad library’s usable permissions steadily increased over two and a half years, with particularly strong growth in READ PHONE STATE and ACCESS NETWORK STATE.The trend appeared both per library and per install.
- Privacy implications: Most permission growth appeared directed toward extracting additional user data rather than improving ad-library operation, except possibly ACCESS NETWORK STATE.Growth included permissions that uniquely identify devices or users, such as READ PHONE STATE and ACCESS WIFI STATE.
- Dangerous permissions: Dangerous permissions remained uncommon but were used by a growing number of libraries, raising concerns about increasingly intrusive advertising.The dangerous-permission set included rare permissions such as SEND SMS, BLUETOOTH, and WRITE EXTERNAL STORAGE.
- Location permissions: ACCESS FINE LOCATION and ACCESS COURSE LOCATION steadily declined, making location permissions the principal exception to the overall upward trend.The decline followed Google’s removal of location code from AdMob and appeared in many other libraries as well.
IV. RELATED WORK
Prior research examined Android application vulnerabilities, ad-library permissions, privacy risks, network traffic, energy use, regulation, and architectural solutions. This work situates the paper within a broader effort to understand and mitigate risks in the Android advertising ecosystem.
- Android security research: Earlier studies used broad app analyses and static analysis to investigate Android security vulnerabilities and potential leaks of personal information.Examples include analyses of 1,100 disassembled apps and static detection of personal-information leaks.
- Ad-library security: Research on Android ad libraries documented permission mismatches, user-tracking weaknesses, JavaScript-exposed system APIs, and other security risks.One study analyzed 13 libraries, while another examined 100 libraries selected from 100,000 apps.
- Ecosystem impacts: Other work examined advertising-related data traffic, energy consumption, the role of personal information in app monetization, and regulatory or monitoring approaches.Network studies also considered energy implications and ways to optimize ad delivery.
- Mitigation approaches: A prominent mitigation approach separates advertisements from applications to isolate permissions and data.The AdSplit framework also considers protecting advertisers from fraudulent behavior by application developers.
V. APP STORE POLICING
The study examined apps removed during a Google Play purge and found that removal rates varied across libraries. Libraries in disproportionately removed apps often used many permissions and exhibited intrusive behaviors, but the evidence was insufficient to establish that their behavior caused removal.
- Removal sample: A Google Play purge left 9,980 sampled apps unavailable, almost 10% of the original sample.Many apps later reappeared, presumably after changes addressing Google’s concerns.
- Library comparison: Apps containing certain ad libraries were much more likely to be removed than others, and Figure 7 lists libraries with disproportionate removal rates.The figure reports missing apps, original apps, removal percentage, and the number of permissions usable by each library.
- Interpretation: The disproportionately removed libraries appeared to use unusually many permissions, but removal of some host apps while others remained suggests Google did not simply ban specific libraries.The authors state that they lacked inside knowledge of Google’s selection criteria.
- Interpretive boundary: The authors identified the removal association too late for deeper analysis, leaving the relationship between library behavior and app deletion for future research.Comparing restored app versions could test whether removed libraries were absent after restoration.
- Additional behavior: Several libraries associated with removed apps also placed launch icons on home screens or advertised push notifications.EverBadge and AirPush placed launch icons, while AirPush, MobPartner, and SendDroid publicized push advertising.
VI. FUTURE WORK
Future work should extend longitudinal sampling, measure when sensitive API calls occur, and characterize information flows among apps, libraries, and ad servers. The paper also emphasizes that bundled libraries share host-app permissions, exposing a weakness in Android’s permission isolation.
- Longitudinal datasets: Repeated Google Play sampling could create a richer longitudinal dataset, while sampling third-party stores could provide an additional dataset.These datasets would support more detailed diachronic studies of the Android ad ecosystem.
- Behavioral measurement: Static analysis could identify when sensitive API calls occur and whether users explicitly trigger them, which matters for privacy assessment.The authors note that greater capability does not necessarily mean less responsible behavior.
- Information flows: Further analysis is needed to understand information exchanged between applications and libraries, and between libraries and ad servers.The authors intend to address these issues in ongoing research.
- Permission isolation: Because ad libraries are bundled within applications, they operate with the host application’s permissions despite Android’s design of separating applications and limiting privileges.This bundling weakness enabled sampling older library versions from currently available applications.
- Conclusion: Ad libraries increasingly used host-requested permissions, with dangerous permissions growing despite use by only a small number of libraries.The paper identifies these permissions as posing particular privacy risks.
IX. APPENDIX 1
The appendix chart reports agency-level ad-library coverage, estimated installations, permission counts, and identifying package names, with AirPush installations explicitly treated as a lower bound.
- Raw data summary: The chart lists each ad agency, the number of apps containing any version of its libraries, estimated installations, qualifying permission counts, and identifying package names.Permissions are counted when used in at least 2% of that agency’s libraries.
- Data qualification: AirPush installation counts are lower bounds because versions with obscured package names were excluded.