MANY ANDROID APPS TALK TO PRIVATE SERVERS …AND
IT’S OFTEN NOT CLEAR WHY ****
A recent report on Android application behavior points to a startling amount of back-end Internet traffic with no benefit to the end-user but a significant impact on battery life. Researchers with MIT and Global InfoTek recently performed an extensive analysis of the top Google Play applications and found a great deal of communication that doesn’t appear to impact any aspect of the customer’s application experience.
What the team found is that 62.7% of the connections made by major Android applications (defined as the top 20 apps in the Google Play Store, disregarding chat programs) could be classified as “covert.” Blocking these applications from connecting to online sources resulted in no visible or measurable change in how the app functioned on the user’s PC.
In some cases, this covert behavior is linked to known A&A (Analytics and Advertising) libraries, but these known libraries acount for just 43% of the total. Many of the rest fall into their own custom areas. The report states:
"Twitter uses covert connections to collect information about videos and other rich media attachments followed by the users in tweets. The GO Keyboard application sends, via a covert connection, a set of ids to the launchermsg.3g.cn server; it also sends some encrypted data, which we could not decode, to nextbrowser.goforandroid.com. Both Pandora and Spotify music players use Facebook’s social graph services [12], sending out information about the application usage. As another example, the Walmart application incorporates the barcode scanner library provided by Red Laser [13] – an eBay company that specializes in comparing prices. This library causes the application to send out information about the scanned barcode to the data.redlaser.com server. Yet, blocking that release of information does not harm the scanning capabilities."
Once the team concluded that their detection and blocking mechanisms accurately captured in-application activity and caused no problems, they applied their search techniques to the top 500 applications in the Google Play store. This expanded sample found that 46.2% of the communication within an application is considered covert. The chart below shows the top connections made to various services.
It’s not at all surprising to see Google’S APIs at the top of the list, but Gameloft’s position is worth an eyebrow. While they only tested 17 Gameloft products in the Top 500, 87.4% of the connections made by Gameloft were covert.
Does this impact battery life?
The obvious answer to the above question is “Yes,” but how much and to what degree is going to be highly application-specific. Applications that maintain a connection to the Internet will already keep your WiFi or cellular radio online, so the added power cost of 1-2 additional connections is low. Gameloft, on the other hand, makes an average of 46 covert calls per application. Even if each of those connections uses very little power, 46 of them at high frequency will add up.
That said, this isn’t particularly surprising. We’ve known for a long time that Android applications were poor stewards of smartphone battery life; many applications that incorporate freemium business models will download huge ads in the background, chewing through bandwidth and leaving the modem active for much longer than it ought to be.
Still, investigations like this reveal part of why major companies continue to suffer from major security problems and consumer privacy breaches. An application developer that builds their product to make dozen of covert connections that have nothing to do with the actual product has little reason to take your privacy seriously — and likely doesn’t.
Obviously application developers have to make money, and connecting to an ad service doesn’t mean the company is doing something wrong– but when applications are making hundreds of connections without notifying the end user, you can bet that you’re taking it on the chin in terms of battery life, privacy, or both.
Comments
Post a Comment