mopri - An Analysis Framework for Unveiling Privacy Violations in Mobile Apps

TL;DR

The paper introduces mopri, a modular analysis framework combining static and dynamic methods to detect privacy violations in mobile apps, aiding compliance verification and user privacy protection.

Contribution

It presents a novel, adaptable framework that integrates various analysis tools into a unified pipeline for comprehensive mobile app privacy analysis.

Findings

Prototype effectively extracts permissions and tracking libraries.

Employs robust dynamic traffic recording and decryption methods.

Enhances analysis clarity with result enrichment and reporting features.

Abstract

Everyday services of society increasingly rely on mobile applications, resulting in a conflicting situation between the possibility of participation on the one side and user privacy and digital freedom on the other. In order to protect users' rights to informational self-determination, regulatory approaches for the collection and processing of personal data have been developed, such as the EU's GDPR. However, inspecting the compliance of mobile apps with privacy regulations remains difficult. Thus, in order to enable end users and enforcement bodies to verify and enforce data protection compliance, we propose mopri, a conceptual framework designed for analyzing the behavior of mobile apps through a comprehensive, adaptable, and user-centered approach. Recognizing the gaps in existing frameworks, mopri serves as a foundation for integrating various analysis tools into a streamlined, modular pipeline that employs static and dynamic analysis methods. Building on this concept, a prototype has been developed which effectively extracts permissions and tracking libraries while employing robust methods for dynamic traffic recording and decryption. Additionally, it incorporates result enrichment and reporting features that enhance the clarity and usability of the analysis outcomes. The prototype showcases the feasibility of a holistic and modular approach to privacy analysis, emphasizing the importance of continuous adaptation to the evolving challenges presented by the mobile app ecosystem.