| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| design:mobile_and_app_measurement [2026/09/10 17:45] – cross-link the new Privacy:Policies page (Authored by Claude) karel.kubicek.claude | design:mobile_and_app_measurement [2026/09/27 16:23] (current) – Add child page pointer (Mini programs) in intro and Related Pages; qualify the Xposed currency row for super-app bridges. Authored by Claude karel.kubicek.claude |
|---|
| |
| Everything on this page about "the literature" is a claim about **seven venues** — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 papers with extracted full text. Mobile-app work is also published at mobile-systems and software-engineering venues (MobiSys, MobiCom, MSR, ICSE, ASE) and at usable-security venues (SOUPS), none of which are in the corpus, so treat the counts as "how these seven security and privacy venues do mobile", not as the state of mobile research.((The absent-venue list is a judgement about where this literature publishes, not a measurement — the corpus cannot see venues it does not contain. Two of the outside-corpus papers cited on this page are from MSR and one from ESEC/FSE, which is the shape of the gap.)) See [[Literature:Corpus]]. | Everything on this page about "the literature" is a claim about **seven venues** — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 papers with extracted full text. Mobile-app work is also published at mobile-systems and software-engineering venues (MobiSys, MobiCom, MSR, ICSE, ASE) and at usable-security venues (SOUPS), none of which are in the corpus, so treat the counts as "how these seven security and privacy venues do mobile", not as the state of mobile research.((The absent-venue list is a judgement about where this literature publishes, not a measurement — the corpus cannot see venues it does not contain. Two of the outside-corpus papers cited on this page are from MSR and one from ESEC/FSE, which is the shape of the gap.)) See [[Literature:Corpus]]. |
| | |
| | **Child page:** [[Design:Mobile and app measurement:Mini programs|Measuring Super-App Mini-Programs]] — WeChat, Alipay, Douyin and other hosts' mini-programs, where the host app rather than the OS is the platform: how a population is built with no store listing, unpacking packages and instrumenting the host, and what the host itself learns. Everything below about acquisition, static and dynamic analysis and pinning applies to the host app there. |
| |
| ===== What to Read First ===== | ===== What to Read First ===== |
| |
| * **A static count is a lower bound on the behaviour and an upper bound on the executed behaviour, simultaneously.** It misses flows it cannot resolve (reflection, JNI, dynamic loading) //and// reports flows that never execute. | * **A static count is a lower bound on the behaviour and an upper bound on the executed behaviour, simultaneously.** It misses flows it cannot resolve (reflection, JNI, dynamic loading) //and// reports flows that never execute. |
| * **You must validate, on your own data.** In the corpus, of the 472 ''appAnalysis'' papers that classified anything, **79 (16.7%) report no validation of any classifier they used**, but only **178 (37.7%) validated //every// classifier they used** — 218 papers (46.2%) have at least one classifier with ''none-reported''. 321 (68.0%) report some manual validation. Manual validation of a sample is cheap and is the single easiest thing a reviewer will ask you for. | * **You must validate, on your own data.** In the corpus, of the 472 ''appAnalysis'' papers that classified anything, **79 (16.7%) report no validation of any classifier they used**, but only **178 (37.7%) validated //every// classifier they used** — 218 papers (46.2%) have at least one classifier with ''none-reported''. 321 (68.0%) report some manual validation. Manual validation of a sample is cheap and is the single easiest thing a reviewer will ask you for. The corpus-wide comparison — 70.1% of all 4,439 classifying papers validate something — and what each of the four validation kinds is worth are on [[Statistics:Annotation]]. |
| |
| Obfuscation and native code are the other half of the problem and they are widespread: **144 of 529** papers mention native code, JNI or the NDK; **85** mention packing or unpacking; **29** name ProGuard, R8 or DexGuard. {[schmidt2023_iotflow]} ran ''APKiD'' to detect packers precisely so it could report which apps its static analysis could not reach. | Obfuscation and native code are the other half of the problem and they are widespread: **144 of 529** papers mention native code, JNI or the NDK; **85** mention packing or unpacking; **29** name ProGuard, R8 or DexGuard. {[schmidt2023_iotflow]} ran ''APKiD'' to detect packers precisely so it could report which apps its static analysis could not reach. |
| |
| ===== The Certificate-Pinning Problem ===== | ===== The Certificate-Pinning Problem ===== |
| | |
| | <WRAP tip> |
| | Everything in this section assumes you can install a CA on the device. On a **television** you usually cannot: Roku, Tizen and webOS expose no route to add a trust anchor at all, and on Android TV there is "no way to install custom certificates", so the APKs have to be instrumented instead. [[Design:Connected TV]] covers what is left when step 1 below is unavailable. |
| | </WRAP> |
| |
| To see an app's traffic you terminate its TLS at a proxy you control. Four things stand between you and that, in order. | To see an app's traffic you terminate its TLS at a proxy you control. Four things stand between you and that, in order. |
| ^ Practice ^ Status ^ Evidence ^ | ^ Practice ^ Status ^ Evidence ^ |
| | Hook the app with **Frida** (+ objection) | **Current, and the field's default.** | 0% of 2010–2015 ''appAnalysis'' papers → 33.3% of 2025–2026; Frida 17.17.0 released 2026-08-05 | | | Hook the app with **Frida** (+ objection) | **Current, and the field's default.** | 0% of 2010–2015 ''appAnalysis'' papers → 33.3% of 2025–2026; Frida 17.17.0 released 2026-08-05 | |
| | Hook with **Xposed** or an Xposed module (JustTrustMe, TrustMeAlready) | **Superseded.** | Xposed archived, last push 2020-06-08; LSPosed's last release is 2023-10-11 and its default branch stopped in January 2024; corpus share fell 10.2% (2016–2020) → 2.2% (2025–2026) | | | Hook with **Xposed** or an Xposed module (JustTrustMe, TrustMeAlready) | **Superseded** for general app hooking (not for hooking super-app bridges: see [[Design:Mobile and app measurement:Mini programs|the mini-programs page]]). | Xposed archived, last push 2020-06-08; LSPosed's last release is 2023-10-11 and its default branch stopped in January 2024; corpus share fell 10.2% (2016–2020) → 2.2% (2025–2026) | |
| | **TaintDroid** for dynamic taint tracking | **Historical.** | 6.8% of 2010–2015 papers, **0% since 2021**, though 84 papers still //mention// it. It is a modified Android 4.x; it cannot run a 2026 app | | | **TaintDroid** for dynamic taint tracking | **Historical.** | 6.8% of 2010–2015 papers, **0% since 2021**, though 84 papers still //mention// it. It is a modified Android 4.x; it cannot run a 2026 app | |
| | **smali / baksmali / dex2jar** as the decompilation step | **Superseded by jadx.** | 17.0% → 3.3%; jadx 0% → 13.3% over the same windows | | | **smali / baksmali / dex2jar** as the decompilation step | **Superseded by jadx.** | 17.0% → 3.3%; jadx 0% → 13.3% over the same windows | |
| ===== Related Pages ===== | ===== Related Pages ===== |
| |
| | * [[Design:Mobile and app measurement:Mini programs|Measuring Super-App Mini-Programs]] — child page: mini-programs inside WeChat, Alipay, Douyin and other super apps, where the host app is the platform. |
| | * [[Statistics:Annotation|Annotation and Validation]] — validating a label set whatever it labels, and the corpus-wide figures this page compares itself against. |
| * [[Design:Website selection]] — the ranking-list problem, which store charts inherit and worsen. | * [[Design:Website selection]] — the ranking-list problem, which store charts inherit and worsen. |
| * [[Design:Sampling]] — how to draw a sample and what to record so the draw is repeatable. | * [[Design:Sampling]] — how to draw a sample and what to record so the draw is repeatable. |
