A study by the Carlos III University of Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) in Berkeley (USA) and Stony Brook University of New York (USA), has analyzed more than 82,000 apps pre-installed on more than 1,700 devices manufactured by 214 brands.
The results of the study reveal the existence of a complex ecosystem of manufacturers, mobile operators, developers and service providers, as well as organizations specialized in monitoring and tracking users as well as advertising on the Internet.
The fact: many of the pre-installed apps provide privileged access to data and system resources without the average user being able to uninstall them.
Android
The permission fee of the Android operating system and its applications allows a large number of actors to monitor and obtain personal information from users and, logically, the end user is unaware of the presence of these spies on their Android devices and the implications that these practices have about your privacy. The fact that it is software with system privileges complicates its elimination for any average user, not for experts, but it is clear that their number is much lower.
The conclusions of the study will be presented at one of the main cybersecurity and privacy conferences in the world, the IEEE Symposium on Security and Privacy in California (USA). Likewise, the Spanish Data Protection Agency (AEPD) has contributed to the dissemination of the study due to the massive impact of the results regarding the privacy of citizens. The AEPD will present the results to the European Data Protection Committee to take action.
This is not everything
Apart from the standard permissions defined in Android, researchers have identified more than 4,845 proprietary or personalized permissions by those involved in the manufacture and distribution of mobile phones. This type of permission allows apps published on Google Play to bypass the Android permission model to access user data without requiring their consent when installing a new app.
What about the pre-installed apps?
The academics have identified more than 1,200 developers behind the pre-installed software, as well as the presence of more than 11,000 third-party libraries (SDKs) included in them, many related to advertising services and online monitoring for commercial purposes. Most cannot be uninstalled from the system.
Lack of transparency
The researchers also expose that there is a lack of transparency of the apps and the Android operating system itself by showing the user a different permissions relationship from the real one, limiting their decision-making capacity to manage their personal information.
What is the AEPD going to do?
The Data Protection Agency will present the conclusions to the European Data Protection Committee (CEPD), a body of the European Union of which it forms part, together with other European data protection authorities and the European Supervisor. According to the AEPD, this study contributes to making it easier for manufacturers, developers and distributors of products and services to apply the principles of Privacy by Default and from Design established in the RGPD in order to safeguard the rights and freedoms of individuals.
Referencia: An Analysis of Pre-installed Android Software Julien Gamba, Mohammed Rashed, Abbas Razaghpanah, Juan Tapiador, Narseo Vallina-Rodriguez https://haystack.mobi/papers/preinstalledAndroidSW_preprint.pdf To appear in the 41st IEEE Symposium on Security and Privacy (IEEE S&P 2020)
