Leaking ads

We have repeatedly warned our readers about the dangers posed by programs of unknown origin. But most people seem to have no qualms about trusting apps from reliable developers and reliable sources: Positive ratings, millions of downloads, and distribution through official stores like Google Play are seen as a badge of security. However, there are no guarantees.

This article is not about Trojans, but about bona fide apps that can nevertheless leak your data online. Our experts studied a total of 13 million APKs (Android application packages) and found that roughly a quarter of them transmit unencrypted data over the Internet. Some of these apps boasted hundreds of millions of downloads, sometimes more than half a billion! This isn’t a small problem.

Information sometimes leaks online because of a developer mistake, but that’s not how it happens in most cases. If called upon to send user data to a server, most apps use the secure HTTPS protocol, which prevents outsiders from intercepting the data. The problem lies in the third-party services that developers plug in without background checks. For example, some analytics or advertising services transmit information over the Internet, but using the standard HTTP protocol, which is not secure.

Most of the data leakage we detected had to do with the device model, its technical specification, network or ISP-related data, and the APK name (by which the system recognizes the package); many services also leaked the smartphone or tablet coordinates.

In some cases, information about app usage was transmitted over HTTP by an embedded third-party service. This information included likes, posts, pages visited, and so forth, as well as details about the owner of the gadget — name, phone number, date of birth. Unique keys created for each authorization request were also often found to be transferred insecurely. Fortunately, most services do not transmit logins and passwords in unencrypted form, although some did.

One in four mobile apps transmits a portion of your personal data over an unprotected channel

Tweet

Information transmitted over HTTP is sent as plain text, allowing almost anyone to read it — including your ISP, for example. What’s more, the path from the app to the third-party server is likely to have several “transit points” in the form of devices that receive and store information for a certain period of time.

Any network equipment, including your home router, may be vulnerable. If hacked, it will give the attackers access to your information. (The ISP, meanwhile, can view that without having to hack anything.) And obtaining some information about the gadget (specifically IMEI and IMSI numbers) is enough to monitor your further actions. The more complete the information, the more of an open book you are to outsiders — from advertisers to fake friends offering malicious files for download.

However, leaks of device and user data are only part of the problem; unencrypted information can also be substituted. For example, in response to an HTTP request from an app, the server might return a video ad, which cybercriminals can intercept and replace with a less innocuous version. Or they might simply change the link inside an ad — and instead of a cute game or deal aggregator, the user risks downloading something far more nefarious.

These issues should really be tackled by app developers. But they can’t be completely trusted to handle the task, so we’ve got a few simple tips to keep you and your data better protected.

• Check the permissions an app requests — it may take time, but it’s never a waste of time, even if the app has millions of downloads to its name. If, say, a messaging app wants to know your location, don’t be bullied into revealing it. See here for more details about Android permissions.
• Buy paid versions of apps, money permitting. They don’t show ads, which means less risk of data leakage. However, they can still make use of third-party analytical modules, which often behave no better.
• Use a VPN — this secure connection will protect your data even if the developers can’t. For example, Kaspersky VPN Secure Connection is just the ticket.