A case of collusion: a study of the interface between ad libraries and their apps

A growing concern with advertisement libraries on Android is their ability to exfiltrate personal information from their host applications. While previous work has looked at the libraries' abilities to extract private information from the system, advertising libraries also include APIs through which a host application can deliberately leak private information about the user. This study, considering a corpus of 114,000 apps, is the first to focus on those APIs. We reconstruct the APIs for 103 ad libraries used in the corpus, and study how the privacy leaking APIs from the top 20 ad libraries are used by the 64,000 applications in which they are included. Notably, we have found that app popularity correlates with privacy leakage; the marginal increase in advertising revenue, multiplied over a larger user base, seems to incentivize these app vendors to violate their users' privacy.