It appears that a number of apps on the market place require a number of ‘permissions’ such as permission to access the files/photos, text messages, contacts, browser history, etc of the phone, usually only when a very specific subset of this functionality is needed. This is an obvious privacy concern, and since there does not seem to be a way to protect user data on Android, it is important to identify apps which steal user data (to sell them to advertisers, or maliciously to sell on the black market, etc).
One way to do this would be to monitor the IP traffic generated by an app, but presumably it is common for such apps to use encryption e.g. SSL, in which case we would need to tamper with the certificates on the device to successfully execute MITM, etc. Not sure if it’s feasible.
My question- has anyone worked on a framework to either reverse-engineer/introspect the apps (maybe to look for certain API calls which retrieve sensitive data, and observe where that data ends up) or monitor their network traffic, in a way that defeats encryption?
It would be interesting to take a look at a number of high-profile apps and see if they adhere to their ‘privacy policy’, or if they harvest everyone’s data because they can get away with it.
On the other hand, I saw someone mention in another question (How to avoid leaking private data to apps without rooting my phone?) that we can read app source code to audit it for such things. Surely this is not true for all apps? Since not all apps are open source./
