An Empirical Analysis of Information Leakage of File Operations on Android External Storage

Current Android apps rely heavily on external storage. When using the external storage, apps apply different security strategies (e.g., randomizing file name, encrypting file content) to prevent privacy risks. Even so, we find that privacy risks still exist, i.e., information leakage of apps' file operations. Users follow their habits to run apps and some of the apps conduct file operations on external storage, which potentially expose users' regular activities. In this paper, we conduct the first empirical study on this problem and implement a file-operation-based pipeline, OP-PERUSE. Besides a dataset of 5,359,339 file operation events collected from the volunteers, we crawl 22,484 app records from the third-party app statistics websites. By combining these data, we get some timely and fine-grained information about the users, e.g., current affiliation, position, habits, etc. To further understand this problem's severity, we conduct a static code analysis on 15,098 apps. We find that 1,305 (8.64%) apps tend to collect file operation events, and more than half of these apps adopt the third-party SDKs which gather file operation events, indicating this problem could have persisted over a long period of time. To prevent this problem, we provide some security recommendations for different stakeholders.