Quantifying Permission-Creep in the Google Play Store
Vincent F. Taylor, Ivan Martinovic

TL;DR
This study analyzes the evolution of dangerous permission usage in Android apps over 20 months, revealing increasing permission requests, especially among popular and free apps, and potential mis-specification of permissions by developers.
Contribution
It provides a longitudinal analysis of dangerous permission trends in Android apps, highlighting issues in permission requests and developer practices.
Findings
Approximately 25,000 apps request more permissions every three months.
Popular and free apps are more likely to request additional permissions.
Evidence suggests developers may mis-specify app permissions.
Abstract
Although there are over 1,600,000 third-party Android apps in the Google Play Store, little has been conclusively shown about how their individual (and collective) permission usage has evolved over time. Recently, Android 6 overhauled the way permissions are granted by users, by switching to run-time permission requests instead of install-time permission requests. This is a welcome change, but recent research has shown that many users continue to accept run-time permissions blindly, leaving them at the mercy of third-party app developers and adversaries. Beyond intentionally invading privacy, highly privileged apps increase the attack surface of smartphones and are more attractive targets for adversaries. This work focuses exclusively on dangerous permissions, i.e., those permissions identified by Android as guarding access to sensitive user data. By taking snapshots of the Google Play…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Privacy, Security, and Data Protection · User Authentication and Security Systems
