There Is Reason Vendors Want You To Use Their Apps – But It Is Not What You Think

A European security research group tested a group of 2,000 apps from the Play Store and found they connected to 250,000 different URLs from 2,000 different domains.

They found one app in the sample, Music Volume Eq, an app designed to control volume, connects to almost 2,000 distinct URLs.

The study said that about 10 percent of the sample connects to more than 500 sites.

There is a difference between apps connecting to user tracking web sites and ad serving sites.  The research says that more than 70  percent of the apps do not connect to a user tracking site, but on the other hand, a few connect to over 800 tracking sites.

Remember that this is a sample and that while 2,000 apps, if well chosen, may be representative, they also may not be.

The team, from Eurecam France, is working on an app that users can run to see where an app is connecting.  The app is called NSA in honor of a certain Northern Virginia Agency.

The article (see here) describing the study seems a little biased and hopefully the data is not.  For example it makes this huge revelation that “9 out of 10 of the most frequently contact (sic) ad-related domains are run by Google”.  Is that a surprise?

They also make the comparison below between Apple and Android, which, while may be true, has nothing to do with ad sites or tracking sites that an app visits.  The researchers do not talk about doing the same exercise with iPhones for some reason, even though it seems logical to do.

“There are essentially two starkly different environments in which to download apps. The first is Apple’s app store, which carefully vets apps before allowing only those deemed fit to appear. The second is the Google Play store, which is more open because Google exercises a lighter touch in vetting apps, only excluding those that are obviously malicious.”

What is important to understand is that most apps and web pages track you, to a greater or lesser extent.  The reasons are usually financial.  For the most part, the tracking is not nefarious, although with the ad networks, there are bad actors who use those networks to deploy malware.  This is all done behind the scenes transparently to the user.  And that data is sliced, diced, packaged, sold and resold.

by