Application privacy scanning systems and related methods
An application privacy analysis system is described, where the system obtains an application and analyzes it for privacy related data use. The system may determine privacy related activities of the application from established sources of such data and/or may decompile the application and analyze the resulting code to determine the privacy related activities of the application. The system may execute the application and monitor the communications traffic exchanged by the application to determine privacy related activities of the application. The system may store the results of such analyses for future reference.
1. A method comprising:
analyzing privacy-related information for a software application on a remote device to generate privacy-related reports to improve privacy compliance of the software application by:
processing, by computing hardware, computer code for the software application on the remote device to determine that the software application collects, requests, or accesses personal data;
analyzing, by the computing hardware and based on processing the computer code, the computer code to determine permissions required for the software application by:
preparing the software application for analysis via an application intake;
reducing the computer code of the software application to machine code by utilizing an application decompiler; and
determining that the computer code uses the permissions to gain access to at least one of device hardware, device storage, or device data of the remote device on which the software application is executing via a static analysis of the computer code;
analyzing, by the computing hardware, a database using the permissions to determine that the software application utilizes the permissions that involves use of personal data of a user in association with using the software application to perform at least one of a privacy-related function, access a privacy-related attribute, or
access a privacy-related characteristic for the permissions that involves use of personal data of a user in association with using the software application;
generating, by the computing hardware, a privacy-related recommendation of the software application for addressing the use of at least one of performing the privacy-related function, accessing the privacy-related attribute, or accessing the privacy-related characteristic for the permissions; and
providing, by the computing hardware, a graphical user interface for displaying the privacy-related recommendation on a computing device, the privacy-related recommendation indicating the privacy compliance of the software application.
2. The method of claim 1 , wherein the device hardware comprises at least one of permissions to access a camera, a microphone, a receiver, or a transmitter of the remote device.
3. The method of claim 1 , wherein the device data comprises at least one of photographs, a calendar, contacts, or location determination residing on the remote device.
4. The method of claim 1 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchain information, advertising identifiers, or encrypted storage residing on the remote device.
5. The method of claim 1 , wherein analyzing the computer code to determine the permissions required for the software application comprises: identifying use of an application programming interface call within the software application configured to access the personal data of the user.
6. The method of claim 1 , wherein analyzing the computer code to determine the permissions required for the software application comprises identifying use of an application programming interface call within the software application configured to transmit the personal data of the user.
7. The method of claim 6 , further comprising:
determining, by the computing hardware, a geographical destination where the personal data is transmitted; and
determining, by the computing hardware, at least one of an applicable privacy law or a privacy regulation on transmitting the personal data based on the geographical destination, wherein the privacy-related recommendation is based on the applicable privacy law or the privacy regulation.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
analyzing privacy-related information for a software application on a remote device to generate privacy-related reports to improve privacy compliance of the software application by:
processing computer code for the software application on the remote device to determine that the software application collects, requests, or accesses personal data;
analyzing, based on processing the computer code, the computer code to determine permissions required for the software application by:
preparing the software application for analysis via an application intake;
reducing the computer code of the software application to machine code by utilizing an application decompiler; and
determining that the computer code uses the permissions to gain access to at least one of device hardware, device storage, or device data of the remote device on which the software application is executing via a static analysis of the computer code;
analyzing a database using the permissions to correlate the permissions to determine that the software application utilizes the permissions that involves use of personal data of a user in association with using the software application to perform at least one of a privacy-related function, access a privacy-related attribute, or
access a privacy-related characteristic for the permissions that involves use of personal data of a user in association with using the software application;
generating a privacy-related recommendation of the software application for addressing the use of at least one of performing the privacy-related function, accessing the privacy-related attribute, or accessing the privacy-related characteristic for the permissions; and
providing a graphical user interface for displaying the privacy-related recommendation on a computing device, the privacy-related recommendation indicating the privacy compliance of the software application.
9. The system of claim 8 , wherein the device hardware comprises at least one of permissions to access a camera, a microphone, a receiver, or a transmitter of the remote device.
10. The system of claim 8 , wherein the device data comprises at least one of photographs, a calendar, contacts, or location determination residing on the remote device.
11. The system of claim 8 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchain information, advertising identifiers, or encrypted storage residing on the remote device.
12. The system of claim 8 , wherein analyzing the computer code to determine the permissions required for the software application comprises identifying use of an application programming interface call within the software application configured to access the personal data of the user.
13. The system of claim 8 , wherein analyzing the computer code to determine the permissions required for the software application comprises identifying use of an application programming interface call within the software application configured to transmit the personal data of the user.
14. The system of claim 13 , wherein the operations further comprise:
determining a geographical destination where the personal data is transmitted; and
determining at least one of an applicable privacy law or a privacy regulation on transmitting the personal data based on the geographical destination, wherein the privacy-related recommendation is based on the applicable privacy law or the privacy regulation.
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
analyzing privacy-related information for a software application on a remote device to generate privacy-related reports to improve privacy compliance of the software application by:
processing computer code for the software application on the remote device to determine that the software application collects, requests, or accesses personal data;
analyzing, based on processing the computer code, the computer code to determine permissions required for the software application by:
preparing the software application for analysis via an application intake;
reducing the computer code of the software application to machine code by utilizing an application decompiler; and
determining that the computer code uses the permissions to gain access to at least one of device hardware, device storage, or device data of the remote device on which the software application is executing via a static analysis of the computer code;
querying a database using the permissions to determine that the software application utilizes the permissions that involves use of personal data of a user in association with using the software application to perform at least one of a privacy-related function, access a privacy-related attribute, or access a privacy-related characteristic for the permissions that involves use of personal data of a user in association with using the software application;
generating a privacy-related recommendation of the software application for addressing the use of at least one of performing the privacy-related function, accessing the privacy-related attribute, or accessing the privacy-related characteristic for the permissions; and
providing a graphical user interface for displaying the privacy-related recommendation on a computing device, the privacy-related recommendation indicating the privacy compliance of the software application.
16. The non-transitory computer-readable medium of claim 15 , wherein the device hardware comprises at least one of permissions to access a camera, a microphone, a receiver, or a transmitter of the remote device.
17. The non-transitory computer-readable medium of claim 15 , wherein the device data comprises at least one of photographs, a calendar, contacts, or location determination residing on the remote device.
18. The non-transitory computer-readable medium of claim 15 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchain information, advertising identifiers, or encrypted storage residing on the remote device.
19. The non-transitory computer-readable medium of claim 15 , wherein analyzing the computer code to determine the permissions required for the software application comprises identifying use of an application programming interface call within the software application configured to access the personal data of the user.
20. The non-transitory computer-readable medium of claim 15 , wherein analyzing the computer code to determine the permissions required for the software application comprises identifying use of an application programming interface call within the software application configured to transmit the personal data of the user.