Forensic Analysis of Smartphone Applications for Privacy Leakage

Diana Hintea; Sandy Taramonli; Bob Bird; R. Yusuf

Forensic Analysis of Smartphone Applications for Privacy Leakage

Diana Hintea, Sandy Taramonli, Bob Bird, R. Yusuf

Department of Information Technology

Research output: Contribution to conference › Paper › peer-review

Abstract

Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps in iOS environments reveal (leak) smartphone version. The paper concludes that much additional work is needed to assess the privacy dominance between platforms and to raise user awareness of smartphone privacy intrusions

Original language	English
Publication status	Published - Apr 2016
Event	11th Annual ADFSL Conference on Digital Forensics, Security and Law - Daytona Beach, United States Duration: 24 May 2016 → 26 May 2016 Conference number: 11

Conference

Conference	11th Annual ADFSL Conference on Digital Forensics, Security and Law
Country/Territory	United States
City	Daytona Beach
Period	24/05/16 → 26/05/16

Bibliographical note

This paper is not available in Pure.

Cite this

@conference{304809be9523484f98d563f551322054,

title = "Forensic Analysis of Smartphone Applications for Privacy Leakage",

abstract = "Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps in iOS environments reveal (leak) smartphone version. The paper concludes that much additional work is needed to assess the privacy dominance between platforms and to raise user awareness of smartphone privacy intrusions",

author = "Diana Hintea and Sandy Taramonli and Bob Bird and R. Yusuf",

note = "This paper is not available in Pure.; 11th Annual ADFSL Conference on Digital Forensics, Security and Law ; Conference date: 24-05-2016 Through 26-05-2016",

year = "2016",

month = apr,

language = "English",

}

TY - CONF

T1 - Forensic Analysis of Smartphone Applications for Privacy Leakage

AU - Hintea, Diana

AU - Taramonli, Sandy

AU - Bird, Bob

AU - Yusuf, R.

N1 - Conference code: 11

PY - 2016/4

Y1 - 2016/4

N2 - Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps in iOS environments reveal (leak) smartphone version. The paper concludes that much additional work is needed to assess the privacy dominance between platforms and to raise user awareness of smartphone privacy intrusions

AB - Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps in iOS environments reveal (leak) smartphone version. The paper concludes that much additional work is needed to assess the privacy dominance between platforms and to raise user awareness of smartphone privacy intrusions

UR - http://commons.erau.edu/adfsl/2016/wednesday/7/

M3 - Paper

T2 - 11th Annual ADFSL Conference on Digital Forensics, Security and Law

Y2 - 24 May 2016 through 26 May 2016

ER -

Forensic Analysis of Smartphone Applications for Privacy Leakage

Abstract

Conference

Bibliographical note

Other files and links

Fingerprint

Cite this