Several researchers have also studied privacy leakages
through ad libraries. TaintDroid [31] and some follow-up
works [6], [32] present results in which a large majority of
privacy leakages happen through ad libraries included in the
applications. While the previous list of works uses dynamic
analysis, researchers have also used static analysis to identify
privacy leaks in applications, and through ad libraries in
particular [33], [34]. Privacy leakages in ad libraries are not in
the scope of this paper. However, we do study scams that extract
personal information of the users, even with their consent.
Grace et al. [35] perform static analysis of ad libraries to
discover a number of implications such as private data leakage
and execution of untrusted advertisement code in applications.
Industry researchers also detected vulnerabilities in ad libraries
that can provide escalated privileges to the advertisement code
that these libraries execute [36]. AdSplit [37] discusses that
ad libraries should be separated from the main application,
running in a different sandbox, so that they can have different
permissions from the applications, and vulnerabilities and
privacy leakages in them do not affect the main application.
Quire [38] also proposed techniques that can achieve a similar
effect. The goal of this paper is not to identify vulnerabilities
due to the inclusion of ad libraries or to fix such problems.
The web links or advertisements embedded in applications may
themselves not be malicious but their end result is.