Showing posts with label statistics. Show all posts
Showing posts with label statistics. Show all posts
Friday, February 17, 2012
Thursday, February 16, 2012
Cydia Apps Leak Less Private Data than iTunes Apps
Users have learned over the last few years that Apple's "walled garden" approach to third party apps isn't quite as protective of their sensitive data as it might sound. More surprising, perhaps, is another revelation: that the popular unauthorized apps outside those walls tend to respect privacy better than the approved ones inside.
After building a tool called PiOS that analyzes private data leaks from iOS apps, the researchers ran their analysis on 1,407 free apps–825 downloaded from Apple's App Store using the website App Tracker, and 526 accessible through BigBoss, the largest repository of unauthorized apps available to users through the Cydia app market for jailbroken iPhones and iPads.
But why would Cydia's unauthorized apps actually leak private data less often than those that Apple approves? Egele points to Cydia's culture of privacy among administrators and users. "The people who run Cydia seem very conscious of what information is available and can be accessed," says Egele. "The applications you get from Cydia are geared toward more privacy-aware people."
I've contacted Apple for comment and will update this post if I hear back from the company.
"If you care about this kind of thing, you should jailbreak your phone," says Freeman. "Instead of Apple making decisions about what's good and bad, you decide. People think jailbreaking is about deciding that things Apple doesn't like are good. But it also allows you to decide that things Apple likes are bad. We provide you the tools to block the functionality you don't believe apps should have on your phone."
After building a tool called PiOS that analyzes private data leaks from iOS apps, the researchers ran their analysis on 1,407 free apps–825 downloaded from Apple's App Store using the website App Tracker, and 526 accessible through BigBoss, the largest repository of unauthorized apps available to users through the Cydia app market for jailbroken iPhones and iPads.
A table from the UCSB study showing how frequently authorized App Store and unauthorized Cydia iOS apps leak private information.
Of those tested apps, 21 percent of official App Store apps uploaded the user's Unique Device Identifier, (UDID) a series of user-specific digits that can be tracked between apps to assemble a profile of a specific person's behavior. Four percent uploaded the device's location, and half a percent uploaded the user's contact list. When the researchers analyzed the unauthorized Cydia apps, on the other hand, only four percent leaked the user's UDID, and only one app out of the 500 tested–a program specifically designed for espionage called MobileSpy–leaked location or contact data.
But why would Cydia's unauthorized apps actually leak private data less often than those that Apple approves? Egele points to Cydia's culture of privacy among administrators and users. "The people who run Cydia seem very conscious of what information is available and can be accessed," says Egele. "The applications you get from Cydia are geared toward more privacy-aware people."
I've contacted Apple for comment and will update this post if I hear back from the company.
"If you care about this kind of thing, you should jailbreak your phone," says Freeman. "Instead of Apple making decisions about what's good and bad, you decide. People think jailbreaking is about deciding that things Apple doesn't like are good. But it also allows you to decide that things Apple likes are bad. We provide you the tools to block the functionality you don't believe apps should have on your phone."
References
- ^ news that the iPhone app Path uploads users' entire contact lists(thenextweb.com) ( http://thenextweb.com/apps/2012/02/07/path-2-uploads-your-address-book-but-says-that-its-for-friend-matching-and-will-be-opt-in-soon/ )
- ^ here (seclab.cs.ucsb.edu) ( http://seclab.cs.ucsb.edu/media/uploads/papers/egele-ndss11.pdf )
- ^ discovery by a Singaporean researcher that the social networking app Path uploads users' contact list (mclov.in) ( http://mclov.in/2012/02/08/path-uploads-your-entire-address-book-to-their-servers.html )
- ^ using security flaws hackers find in iOS's code (www.forbes.com) ( http://www.forbes.com/sites/andygreenberg/2011/08/01/meet-comex-the-iphone-uber-hacker-who-keeps-outsmarting-apple/ )
- ^ ContactPrivacy (www.cultofmac.com) ( http://www.cultofmac.com/145112/how-to-keep-apps-like-path-from-accessing-your-contacts-data-jailbreak/ )
- ^ PrivaCy (cydia.saurik.com) ( http://cydia.saurik.com/package/com.saurik.privacy )
- ^ here (seclab.cs.ucsb.edu) ( http://seclab.cs.ucsb.edu/media/uploads/papers/egele-ndss11.pdf )
- As the scandal swirled this past week over news that the iPhone app Path uploads users' entire contact lists 1 without permission, I came upon a study (PDF here 2 ) released last year by a group of researchers at the University of California at Santa Barbara and the International Security Systems Lab that aimed to analyze how and where iPhone apps transmit users' private data. Not only did the researchers find that one in five of the free apps in Apple's app store upload private data back to the apps' creators that could potentially identify users and allow profiles to be built of their activities. They also discovered that programs in Cydia, the most popular platform for unauthorized apps that run only on "jailbroken" iPhones, tend to leak private data far less frequently than Apple's approved apps.
- For Manuel Egele, a post-doctoral researcher at UCSB, the discovery by a Singaporean researcher that the social networking app Path uploads users' contact list 3 only confirms a pattern he and his co-authors have long seen. Four of the Apple-approved apps he tested last year were found to similarly upload contacts, including one from the location-based social network Gowalla. "Clearly this behavior hasn't changed over the last year. I'm not sure whether there's been any improvement from Apple's side," Egele says. "For easily accessible data, app store apps are much more frequently accessing and leaking that data. The app store is supposed to be a walled garden. Unless Apple gives approval, you can't put things there. But whatever job the company is doing isn't good enough."
- With somewhere between 10 million and 15 million users, Cydia's app platform has become the default unofficial app store of users who jailbreak their iPhones and iPads, hacking them to install applications and operating system tweaks that Apple restrictions are designed to block. That kind of device hacking, using security flaws hackers find in iOS's code 4 to unlock its restrictions against running unapproved code, also introduces new security and privacy risks for users by stripping away the phone or tablet's security features and leaving the device open to malware.
- But Jay Freeman, Cydia's creator, points to numerous applications available via Cydia that actually give users privacy and security features they wouldn't otherwise have. Immediately after the Path scandal broke, for instance, a developer named Ryan Petrich created a tweak for Cydia called ContactPrivacy 5that warns the user whenever an application wants to upload his or her contact information, (shown above) rather than simply allowing the data to be transmitted by default. Another app that Freeman wrote himself, called PrivaCy 6 , gives the users a toggle switch that allows them to control whether any particular app can upload usage statistics to a remote server.
- Read the study from the International Security Systems Lab and the University of California at Santa Barbara here 7 .
Monday, February 13, 2012
BitTorrent doesn’t hurt US box-office, delayed international releases drive downloading
Economics researchers at Wellesley College and U Missouri have published a study showing that feature films' US box office returns are not correlated to BitTorrent sharing. They also show that shorter delays between the US exhibition and overseas releases result in less file-sharing — that is, people outside the US download movies because they can't buy tickets to them.
Maybe they'll still buy tickets to the cinema, too. I'd guess that a lot of middle-class families with small children will do this. There aren't many kids' movies in cinematic release at the moment, and Muppets is certainly the best bet for a Sunday matinee during the record-breaking cold-snap, when no one wants to take the kids to a park on the weekend. But child-free adults who love the Muppets may well have slaked their thirst, and there are a lot of adults in the Muppet cohort, and adults who like kids' movies often complain about paying a lot of money to attend screenings that are disrupted by crying, talking, squirming children. If you've already seen the movie on your computer, that may be enough. Finally, there are families in the "squeezed middle" who are struggling to pay the bills may want to see the movie in the cinema, but simply lack the funds to do so, and the amount of time that's gone past since the initial release has meant that there are more online copies and that they're easier to download (for example, more BitTorrent seeds) than ever before. For them, the delayed release makes downloading easier and more attractive.
"Anti-piracy" efforts are often painted as life-or-death struggles for the studios. But in the case of international windows, this is about profit maximization, not survival. If the studios can outsource the titanic expense of policing copyrights in delayed-release nations to the countries themselves, they can wring a few more points of profit by delaying release to an otherwise optimum moment. But considered as a societal problem, it makes no sense to spend a million euros on copyright enforcement just so Universal can save a few thousand euros on the cost of making new 35mm prints.
Here's the study: Reel Piracy: The Effect of Online Film Piracy on International Box Office Sales , by Brett Danaher (Wellesley College - Department of Economics) and Joel Waldfogel (University of Minnesota - Twin Cities - Carlson School of Management ; National Bureau of Economic Research (NBER); University of Minnesota - Twin Cities - Department of Economics).
"Consumers in the US who would choose between the box office and piracy choose the box office (and the remaining US pirates had valuations lower than the ticket price) but that international consumers who would consider both options choose piracy due to a lack of legal availability," wrote the researchers. "If piracy displaced box office sales in the US, we would have expected the slope of the returns profile to shift more significantly as BitTorrent became more widely adopted."
In other words, researchers were unable to discern an irregular drop in returns of domestic box office sales, which could fault BitTorrent as the culprit.
Despite the mounting evidence and studies providing evidence to the needlessness of the movie studios' assault against file-sharing services, their attacks have been intensifying. At the end of the day, these results suggest that, while directing the blame at file-sharing services induces the fear of prosecution among other file-sharing competitors, much of the power to curb piracy remains in the hands of the studios.
Subscribe to:
Posts (Atom)