More Like this

1. Feature creep or just plain creepy? How advances in “smart” technologies affect attitudes toward data privacy

   Vitak, J. (January 2020, Annals of the International Communication Association)

   Smart home technologies on our phones and in our homes are collecting more (quantity) and more (types of) data about us. These tools are intended to simplify everyday tasks, but to do so effectively, they collect significant data about users and their environment. One popular example includes intelligent personal assistants (IPAs) like Apple’s Siri, Amazon’s Alexa, and Google’s Assistant. As these services have transitioned from being embedded in consumers’ smartphones to standalone devices in the home, they have evolved to collect and share more data in more potentially invasive ways. In this paper, we consider American adults’ attitudes toward IPAs. Through an analysis of focus groups with IPA users and non-users, we describe attitudes and concerns toward IPAs broadly, as well as how these attitudes vary based on the devices’ features. We suggest new frameworks for evaluating privacy-based decisions and offer policy suggestions for regulating data flows from smart technologies. 

   more » « less
2. Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile Apps

   https://doi.org/10.1109/SP.2019.00009  

   Zuo, Chaoshun; Lin, Zhiqiang; Zhang, Yinqian (May 2019, 2019 IEEE Symposium on Security and Privacy)

   Increasingly, more and more mobile applications (apps for short) are using the cloud as the back-end, in particular the cloud APIs, for data storage, data analytics, message notification, and monitoring. Unfortunately, we have recently witnessed massive data leaks from the cloud, ranging from personally identifiable information to corporate secrets. In this paper, we seek to understand why such significant leaks occur and design tools to automatically identify them. To our surprise, our study reveals that lack of authentication, misuse of various keys (e.g., normal user keys and superuser keys) in authentication, or misconfiguration of user permissions in authorization are the root causes. Then, we design a set of automated program analysis techniques including obfuscation-resilient cloud API identification and string value analysis, and implement them in a tool called LeakScope to identify the potential data leakage vulnerabilities from mobile apps based on how the cloud APIs are used. Our evaluation with over 1.6 million mobile apps from the Google Play Store has uncovered 15, 098 app servers managed by mainstream cloud providers such as Amazon, Google, and Microsoft that are subject to data leakage attacks. We have made responsible disclosure to each of the cloud service providers, and they have all confirmed the vulnerabilities we have identified and are actively working with the mobile app developers to patch their vulnerable services. 

   more » « less
3. Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile Apps

   Zuo, Chaoshun; Lin, Zhiqiang; Zhang, Yinqian (January 2019, IEEE Symposium on Security and Privacy)

   Increasingly, more and more mobile applications (apps for short) are using the cloud as the back-end, in particular the cloud APIs, for data storage, data analytics, message notification, and monitoring. Unfortunately, we have recently witnessed massive data leaks from the cloud, ranging from personally identifiable information to corporate secrets. In this paper, we seek to understand why such significant leaks occur and design tools to automatically identify them. To our surprise, our study reveals that lack of authentication, misuse of various keys (e.g., normal user keys and superuser keys) in authentication, or misconfiguration of user permissions in authorization are the root causes. Then, we design a set of automated program analysis techniques including obfuscation-resilient cloud API identification and string value analysis, and implement them in a tool called LeakScope to identify the potential data leakage vulnerabilities from mobile apps based on how the cloud APIs are used. Our evaluation with over 1.6 million mobile apps from the Google Play Store has uncovered 15, 098 app servers managed by mainstream cloud providers such as Amazon, Google, and Microsoft that are subject to data leakage attacks. We have made responsible disclosure to each of the cloud service providers, and they have all confirmed the vulnerabilities we have identified and are actively working with the mobile app developers to patch their vulnerable services. 

   more » « less
4. Not Your Father's Big Data (Lighting Talk)

   Carl Nuessle, Oliver Kennedy (January 2019, Conference on Innovative Data Systems Research (CIDR))

   Embedded database libraries provide developers with a com- mon and convenient data persistence layer. They have spread to many systems, including interactive devices like smart- phones, appearing in all major mobile systems. Their perfor- mance affects the response times and resource consumption of millions of phone apps and billions of phone users. It is thus critical that we better understand how they work, so they can be used more efficiently, and so developers can make faster libraries. Mobile databases differ significantly from server-class storage in terms of platform, usage, and measurement. Phones are multi-tenant, end-user devices that the database must share with other apps. Contrary to traditional database design goals, workloads on phones are single-app, bursty, and rarely saturate the CPU. We argue that mobile storage design should refocus on what matters on the mobile platform: latency and energy. As accurate per- formance measurement tools are necessary to evaluation of good database design, this uncovers another issue: Tradi- tional database benchmarking methods produce misleading results when applied to mobile devices, due to evaluating performance at saturation. Development of databases and measurements specifically designed for the mobile platform is necessary to optimize user experience of the most common database usage in the world. 

   more » « less
5. Leveraging mobile phones to attain sustainable development

   https://doi.org/10.1073/pnas.1909326117  

   Rotondi, Valentina; Kashyap, Ridhi; Pesando, Luca Maria; Spinelli, Simone; Billari, Francesco C. (June 2020, Proceedings of the National Academy of Sciences)

   null (Ed.)

   For billions of people across the globe, mobile phones enable relatively cheap and effective communication, as well as access to information and vital services on health, education, society, and the economy. Drawing on context-specific evidence on the effects of the digital revolution, this study provides empirical support for the idea that mobile phones are a vehicle for sustainable development at the global scale. It does so by assembling a wealth of publicly available macro- and individual-level data, exploring a wide range of demographic and social development outcomes, and leveraging a combination of methodological approaches. Macro-level analyses covering 200+ countries reveal that mobile-phone access is associated with lower gender inequality, higher contraceptive uptake, and lower maternal and child mortality. Individual-level analyses of survey data from sub-Saharan Africa, linked with detailed geospatial information, further show that women who own a mobile phone are better informed about sexual and reproductive health services and empowered to make independent decisions. Payoffs are larger among the least-developed countries and among the most disadvantaged micro-level clusters. Overall, our findings suggest that boosting mobile-phone access and coverage and closing digital divides, particularly among women, can be powerful tools to attain empowerment-related sustainable development goals, in an ultimate effort to enhance population health and well-being and reduce poverty. 

   more » « less