University Researchers Show How Widely Mobile Apps Share Users' Personal Information

Nearly three-quarters of Android apps and close to half of iOS apps are inappropriately sharing smartphone users’ personal information, according to a joint study from MIT, Carnegie Mellon and Harvard.

“Who Knows What About Me? A Survey of Behind-the-Scenes Personal Data Sharing to Third Parties by Mobile Apps” is a pretty damning indictment of the way developers handle the personal information they get when users download their products. In a random look at 55 apps across both platforms, for example, the study found 47 percent of iOS apps share location data about the iPhone customers, while a staggering 73 percent of Android apps offer email addresses without explicit consent.

Although it’s unlikely many of these apps are offering personal information to cybercriminals, the study shows an apparent lack of accountability in how data moves from one organization to another. As BusinessInsider reported, many of the details seem innocuous enough, such as the iOS version of Instagram sending birthday, gender and location to Apple. In 3 out of 10 medical, health and fitness apps, however, what’s being collected includes in-app search histories for medical terms.

To prove how much spying is going on within mobile apps, the researchers tracked HTTP and HTTPS traffic and then identified personal information that went to third-party domains, according to BBC News. In some cases, the results were mysterious, such as the fact that 93 percent of Android apps covered in the study connected to Safemovedm.com. Privacy International told BBC the report documented a betrayal of smartphone users’ trust and raised questions about possible future data retention legislation.

Although neither Google nor Apple responded to requests from several outlets for comment, it’s not as though they’re unaware of the potential fallout. Just a few weeks ago, for example, a story on Ars Technica said Apple had pulled more than 250 iOS apps from its App Store for violating its privacy policy and collecting personal information from private APIs.

Apple, of course, has been making its approach to privacy a centerpiece of its strategy, with an in-depth policy update earlier this year. As this research proves, however, the problem may be one of mobile OS providers coaching developers on the boundaries for data sharing — and providing more enforcement when necessary.

Shane Schick

Writer & Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates