Automating Privacy Testing of Smartphone Applications

Smartphones have revolutionized mobile computing, but have created concerns that many third-party mobile applications do not properly handle users’ privacy-sensitiv e data. In this paper, we propose AppInspector, an automated privacy validation system that analyzes apps and generates reports of potential privacy risks. A key insight is that distinguishing acceptable disclosures from privac y violations often requires analyzing the context in which data is transmitted. Just knowing that sensitive data has left a device is insufficient. We describe our vision for making smartphone apps more secure through automated testing and outline key challenges such as detecting and analyzing privacy violations, ensuring thorough test coverage, and scaling to large numbers of apps.