The Case for Mobile Forensics of Private Data Leaks: Towards Large-Scale User-Oriented Privacy Protection

Privacy protection against mobile applications on mobile de-vices is becoming a serious concern as user sensitive data may be leaked without proper justification. Most current leak detection tools only report leaked private data, but pro-vide inadequate information about the causes of the leaks for end users to take preventive measures. Hence, users of-ten cannot reconcile the way they have used an application to a reported leak — i.e., they are unable to comprehend the (il)legitimacy of the leak or make a decision on whether to allow the leak. This paper aims to demonstrate the feasibili-ty and benefits of identifying the causes of leaks from a us-er’s point of view, which we call mobile forensics of privacy leaks. Its goal is to correlate user actions to leaks, and report the causes from a user-oriented perspective. To make the case, we have performed a preliminary study that identifies leak causes based on logs of user actions in more than 220 Android applications and corresponding leak reports from a leak detection tool. Our results show that more than 60% of the 105 applications (of the 220 we sampled) that leak private data leak data do so due to user actions on certain in-application GUI widgets. About 44 % also leak data right after users launch them, while 32 % leak data periodically af-ter launch. We also constructed a database containing leak causes from all tested apps, and demonstrated the use of vi-sual overlays to warn users about potential leaks. 1