Exploiting Third-party SDK Sensitive Data Leakage

Data leakage is a critical threat to app developers because apps use and reserve a variety of sensitive data collected from users. While using third-party SDK is a common way to build apps, some accessed data may not be perceived by app developers. Therefore, the use of third-party SDKs may cause data leakage. This work proposes a platform named "WaRning-Awareness Platform" (WRAP). WRAP records profiles of SDKs, and reveals sensitive data accessed by SDKs. To demonstrate the data leakage caused by third-party SDKs, this work conducts a case study with various categories of Android apps. The result of our case study indicates that if app developers do not pay attention to the accessed data, the data would be leaked.