The team’s study fol\u00adlowed 31 mobile device users with iOS devices and Android devices who used ReCon for a period of one week to 101 days and then mon\u00adi\u00adtored their per\u00adsonal leak\u00adages through a ReCon secure\u00a0webpage.<\/p>\n
The results were alarming. \u201cDepress\u00adingly, even in our small user study we found 165 cases of cre\u00adden\u00adtials being leaked in plain\u00adtext,\u201d the researchers wrote.<\/p>\n
Of the top 100 apps in each oper\u00adating system\u2019s app store that par\u00adtic\u00adi\u00adpants were using, more than 50 per\u00adcent leaked device iden\u00adti\u00adfiers, more than 14 per\u00adcent leaked actual names or other user iden\u00adti\u00adfiers, 14–26 per\u00adcent leaked loca\u00adtions, and three leaked pass\u00adwords in plain\u00adtext. In addi\u00adtion to those top apps, the study found sim\u00adilar pass\u00adword leaks from 10 addi\u00adtional apps that par\u00adtic\u00adi\u00adpants had installed and\u00a0used.<\/p>\n
The password-leaking apps included Map\u00adMyRun, the lan\u00adguage app Duolingo, and the Indian dig\u00adital music app Gaana. All three devel\u00adopers have since fixed the leaks. Sev\u00aderal other apps con\u00adtinue to send plain\u00adtext pass\u00adwords into traffic, including a pop\u00adular dating\u00a0app.<\/p>\n
\u201c<\/strong>What\u2019s really trou\u00adbling is that we even see sig\u00adnif\u00adi\u00adcant num\u00adbers of apps sending your pass\u00adword, in plain\u00adtext read\u00adable form, when you log in,\u201d says Choffnes. In a public-WiFi set\u00adting, that means anyone run\u00adning \u201csome pretty simple soft\u00adware\u201d could nab\u00a0it.<\/p>\n Screen capture of the ReCon user interface. Users can view how their\u00a0personally identifiable information is leaked, validate the suspected leaks, and create custom filters to block or modify leaks. (credit: Jingjing Ren et al.\/arXiv)<\/p><\/div>\n Apps that\u00a0track<\/strong><\/p>\n Access settings for an iPhone app (credit: KurzweilAI)<\/p><\/div>\n Apps, like many other dig\u00adital prod\u00aducts, con\u00adtain soft\u00adware that tracks our com\u00adings, goings, and details of who we are. If you look in the pri\u00advacy set\u00adting on your iPhone, you\u2019ll see this state\u00adment:<\/p>\n \u201cAs appli\u00adca\u00adtions request access to your data, they will be added in the cat\u00ade\u00adgories above.\u201d<\/p>\n Those cat\u00ade\u00adgories include \u201cLoca\u00adtion Ser\u00advices,\u201d \u201cCon\u00adtacts,\u201d \u201cCal\u00aden\u00addars,\u201d \u201cReminders,\u201d \u201cPhotos,\u201d \u201cBlue\u00adtooth Sharing,\u201d and\u00a0\u201cCamera.\u201d<\/p>\n Although many users don\u2019t realize it, they have con\u00adtrol over that access. \u201cWhen you install an app on a mobile device, it will ask you for cer\u00adtain per\u00admis\u00adsions that you have to approve or deny before you start using the app,\u201d explains Choffnes. \u201cBecause I\u2019m a bit of a pri\u00advacy nut, I\u2019m even selec\u00adtive about which apps I let know my loca\u00adtion.\u201d For a nav\u00adi\u00adga\u00adtion app, he says, fine. For others, it\u2019s not so\u00a0clear.<\/p>\n One reason that apps track you, of course, so is so devel\u00adopers can recover their costs. Many apps are free, tied in with tracking soft\u00adware, sup\u00adplied by adver\u00adtising and ana\u00adlytics net\u00adworks, that gen\u00ader\u00adates rev\u00adenue when users click on the tar\u00adgeted ads that pop up on their\u00a0phones.<\/p>\n ReCon<\/strong><\/p>\n Using ReCon is easy, Choffnes says. Par\u00adtic\u00adi\u00adpants install a vir\u00adtual pri\u00advate net\u00adwork, or\u00a0VPN, on their devices — an easy six- or seven-step process. The\u00a0VPN\u00a0then securely trans\u00admits users\u2019 data to the system\u2019s server, which runs the ReCon soft\u00adware, iden\u00adti\u00adfying when and what infor\u00adma\u00adtion is being\u00a0leaked.<\/p>\n To learn the status of their infor\u00adma\u00adtion, par\u00adtic\u00adi\u00adpants simply log onto the ReCon secure web\u00adpage. There they can find things like a Google map pin\u00adpointing which of their apps are zap\u00adping their loca\u00adtion to other des\u00adti\u00adna\u00adtions and which apps are releasing their pass\u00adwords into unen\u00adcrypted net\u00adwork traffic. They can also tell the system what they want to do about\u00a0it.<\/p>\n \u201cOne of the advan\u00adtages to our approach is you don\u2019t have to tell us your infor\u00adma\u00adtion, for example, your pass\u00adword, email, or gender,\u201d says Choffnes. \u201cOur system is designed to use cues in the net\u00adwork traffic to figure out what kind of infor\u00adma\u00adtion is being leaked. The soft\u00adware then auto\u00admat\u00adi\u00adcally extracts what it sus\u00adpects is your per\u00adsonal infor\u00adma\u00adtion. We show those find\u00adings to users, and they tell us if we are right or wrong. That per\u00admits us to con\u00adtin\u00adu\u00adally adapt our system, improving its accuracy.\u201d<\/p>\n The team\u2019s eval\u00adu\u00ada\u00adtive study showed that ReCon iden\u00adti\u00adfies leaks with 98 per\u00adcent accuracy.<\/p>\n \u201cThere are other tools that will show you how you\u2019re being tracked but they won\u2019t nec\u00ades\u00adsarily let you do any\u00adthing,\u201d says Choffnes. \u201cAnd they are mostly focused on tracking behavior and not the actual per\u00adsonal infor\u00adma\u00adtion that\u2019s being sent out. ReCon covers a wide range of infor\u00adma\u00adtion being sent out over the net\u00adwork about you, and auto\u00admat\u00adi\u00adcally detects when your infor\u00adma\u00adtion is leaked without having to know in advance what that infor\u00adma\u00adtion\u00a0is. You can [also] set poli\u00adcies to change how your infor\u00adma\u00adtion is being released.\u201d<\/p>\n A demo of ReCon is available here<\/a>.<\/p>\n Choffnes presented his\u00a0find\u00adings in an open-access paper<\/a> Monday Nov. 16 at the\u00a0Data Trans\u00adparency Lab 2015 Con\u00adfer\u00adence<\/a>,\u00a0held at the MIT Media Lab.<\/p>\n Abstract of\u00a0ReCon: Revealing and Controlling Privacy Leaks in Mobile Network Traffic<\/em><\/strong><\/p>\n It is well known that apps running on mobile devices extensively track and leak users’ personally identifiable information (PII); however, these users have little visibility into PII leaked through the network traffic generated by their devices, and have poor control over how, when and where that traffic is sent and handled by third parties. In this paper, we present the design, implementation, and evaluation of ReCon: a cross-platform system that reveals PII leaks and gives users control over them without requiring any special privileges or custom OSes. ReCon leverages machine learning to reveal potential PII leaks by inspecting network traffic, and provides a visualization tool to empower users with the ability to control these leaks via blocking or substitution of PII. We evaluate ReCon’s effectiveness with measurements from controlled experiments using leaks from the 100 most popular iOS, Android, and Windows Phone apps, and via an IRB-approved user study with 31 participants. We show that ReCon is accurate, efficient, and identifies a wider range of PII than previous approaches.<\/p>\n","protected":false},"excerpt":{"rendered":" A Northeastern University research team has found “extensive” leakage of users’ information — device and user identifiers, locations, and passwords — into network traffic from apps on mobile devices, including iOS, Android, and Windows phones. The researchers have also devised a way to stop the flow. David Choffnes, an assistant professor in the College of Computer and Information Science, […]<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[53,43],"tags":[],"class_list":["post-3489","post","type-post","status-publish","format-standard","hentry","category-internetcloudtelecom","category-news"],"_links":{"self":[{"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/posts\/3489"}],"collection":[{"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/comments?post=3489"}],"version-history":[{"count":1,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/posts\/3489\/revisions"}],"predecessor-version":[{"id":3490,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/posts\/3489\/revisions\/3490"}],"wp:attachment":[{"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/media?parent=3489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/categories?post=3489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hoo.central12.com\/fugic\/wp-json\/wp\/v2\/tags?post=3489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"http:\/\/www.kurzweilai.net\/images\/ReCon-user-interface.jpg\" "\\"ReCon")
<\/a>![\"\"](\"http:\/\/www.kurzweilai.net\/images\/Access-setting.jpg\" "\\"Access")
\n