1. Mobile App Advertisements
Matt Base
CSCE 390
April 11, 2012
References:
“Study: Including Ads in Mobile Apps Poses Privacy, Security Risks”
“Unsafe Exposure Analysis of Mobile In-App Advertisements”
Paper by Michael Grace, Wu Zhou, and Xuxian Jiang Department of Computer Science, North Carolina State University;Ahmad-Reza Sadeghi,Technical University Darmstadt

2. NC State Study of 100,000 apps in Google Play (Android)
Overview
NC State Study of 100,000 apps in Google Play (Android)
52% contained in-app advertisement libraries, most of which collect personal data.
Some APIs the ad libraries were allowed access to
- Read Installed Packages
- Location Data
- List Accounts
- Read Calendar
- Change Calendar
- Read Contact/Call Logs
- Read Browser Bookmarks
- Read Phone Information
(returns phone's IMEI#)
- Read Phone Number
- Read SMS
297 apps contained ad libraries that allow code to be dynamically loaded at runtime

3. Ethical Decision-Making Process
Ethical Issues:
- Advertisers are being allowed access to personal
information beyond what is useful for ad targeting.
- Code that can be dynamically loaded at runtime
from the internet is DANGEROUS. (root exploits,
botnet payloads, etc.)
Stakeholders:
- Smartphone Users
- App Developers
- Advertisers
- Cellular Service Providers

4. Ethical Decision-Making Process
Potential Solutions:
Change Nothing. Allow ad libraries nearly full access to all data present on phone. Also continue to allow ad libraries to dynamically load code from potentially unsecure sources.
Allow ad libraries NO access to phone's data, do not allow dynamic code loading.
Find a better way to integrate ad libraries in Android apps. Limit sources from which code can be dynamically loaded, and allow access to a limited amount of personal data that is relevant to ad targeting.

5. ACM Code of Ethics
Relevant Sections:
1.2 – Allowing code to be dynamically loaded at runtime from a potentially malicious or compromised source is making no effort to avoid harm to others.
1.3 – Although the user is almost always informed when personal data is being collected, cases exist where the user is not fully aware what information is being gathered.
1.7 – Collecting data that is not relevant to ad targeting is dishonest.