{"id":"https://openalex.org/W4410475044","doi":"https://doi.org/10.56553/popets-2025-0103","title":"Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning SDKs in Android","display_name":"Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning SDKs in Android","publication_year":2025,"publication_date":"2025-05-19","ids":{"openalex":"https://openalex.org/W4410475044","doi":"https://doi.org/10.56553/popets-2025-0103"},"language":"en","primary_location":{"id":"doi:10.56553/popets-2025-0103","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2025-0103","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.56553/popets-2025-0103","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5067900210","display_name":"Aniketh Girish","orcid":"https://orcid.org/0000-0002-2895-125X"},"institutions":[{"id":"https://openalex.org/I2802499160","display_name":"IMDEA Networks","ror":"https://ror.org/04mm9fg30","country_code":"ES","type":"facility","lineage":["https://openalex.org/I105140100","https://openalex.org/I2802499160"]},{"id":"https://openalex.org/I50357001","display_name":"Universidad Carlos III de Madrid","ror":"https://ror.org/03ths8210","country_code":"ES","type":"education","lineage":["https://openalex.org/I50357001"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Aniketh Girish","raw_affiliation_strings":["IMDEA Networks Institute/Universidad Carlos III de Madrid"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IMDEA Networks Institute/Universidad Carlos III de Madrid","institution_ids":["https://openalex.org/I2802499160","https://openalex.org/I50357001"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059746228","display_name":"Joel Reardon","orcid":"https://orcid.org/0000-0001-9702-775X"},"institutions":[{"id":"https://openalex.org/I168635309","display_name":"University of Calgary","ror":"https://ror.org/03yjb2x39","country_code":"CA","type":"education","lineage":["https://openalex.org/I168635309"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Joel Reardon","raw_affiliation_strings":["University of Calgary"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Calgary","institution_ids":["https://openalex.org/I168635309"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070199150","display_name":"Juan Tapiador","orcid":"https://orcid.org/0000-0002-4573-3967"},"institutions":[{"id":"https://openalex.org/I50357001","display_name":"Universidad Carlos III de Madrid","ror":"https://ror.org/03ths8210","country_code":"ES","type":"education","lineage":["https://openalex.org/I50357001"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Juan Tapiador","raw_affiliation_strings":["Universidad Carlos III de Madrid"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universidad Carlos III de Madrid","institution_ids":["https://openalex.org/I50357001"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079790457","display_name":"Srdjan Matic","orcid":"https://orcid.org/0000-0003-2822-3970"},"institutions":[{"id":"https://openalex.org/I4210162154","display_name":"IMDEA Software Institute","ror":"https://ror.org/04xvfkh51","country_code":"ES","type":"facility","lineage":["https://openalex.org/I105140100","https://openalex.org/I4210162154"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Srdjan Matic","raw_affiliation_strings":["IMDEA Software Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IMDEA Software Institute","institution_ids":["https://openalex.org/I4210162154"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016569835","display_name":"Narseo Vallina-Rodr\u00edguez","orcid":"https://orcid.org/0000-0002-5420-6835"},"institutions":[{"id":"https://openalex.org/I2802499160","display_name":"IMDEA Networks","ror":"https://ror.org/04mm9fg30","country_code":"ES","type":"facility","lineage":["https://openalex.org/I105140100","https://openalex.org/I2802499160"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Narseo Vallina-Rodriguez","raw_affiliation_strings":["IMDEA Networks Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IMDEA Networks Institute","institution_ids":["https://openalex.org/I2802499160"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.5663,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.88142542,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"2025","issue":"3","first_page":"361","last_page":"381"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9872000217437744,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9872000217437744,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9842000007629395,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12238","display_name":"Green IT and Sustainability","score":0.964900016784668,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6986021995544434},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5585651993751526},{"id":"https://openalex.org/keywords/wireless","display_name":"Wireless","score":0.5563477873802185},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4740164875984192},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4661940634250641},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.33112800121307373},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12755289673805237}],"concepts":[{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6986021995544434},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5585651993751526},{"id":"https://openalex.org/C555944384","wikidata":"https://www.wikidata.org/wiki/Q249","display_name":"Wireless","level":2,"score":0.5563477873802185},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4740164875984192},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4661940634250641},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.33112800121307373},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12755289673805237}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.56553/popets-2025-0103","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2025-0103","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.56553/popets-2025-0103","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2025-0103","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2165251242","https://openalex.org/W1991580985","https://openalex.org/W3134738208","https://openalex.org/W2537703159","https://openalex.org/W589730254","https://openalex.org/W1974021515","https://openalex.org/W2829478414","https://openalex.org/W1017447425","https://openalex.org/W2966745404","https://openalex.org/W2087052710"],"abstract_inverted_index":{"Mobile":[0],"apps":[1,154],"frequently":[2],"use":[3,73],"Bluetooth":[4,180],"Low":[5],"Energy":[6],"(BLE)":[7],"and":[8,18,41,78,93,117,141,167,179,189,196,201,217,231,247],"WiFi":[9,21,178],"scanning":[10,76,132],"permissions":[11],"to":[12,20,56,129,137,208,251],"discover":[13],"nearby":[14],"devices":[15,52],"like":[16,46],"peripherals":[17],"connect":[19],"Access":[22],"Points":[23],"(APs).":[24],"However,":[25],"wireless":[26,75,91,135],"interfaces":[27],"also":[28],"serve":[29],"as":[30,171,238],"a":[31,122],"covert":[32],"proxy":[33],"for":[34,81],"geolocation":[35],"data,":[36],"enabling":[37,218],"continuous":[38],"user":[39,168,215],"tracking":[40],"profiling.":[42],"This":[43],"includes":[44],"technologies":[45,95],"BLE":[47,51],"beacons,":[48],"which":[49],"are":[50,64,199],"broadcasting":[53],"unique":[54],"identifiers":[55,169,198],"determine":[57],"devices'":[58],"indoor":[59],"physical":[60],"locations;":[61],"such":[62,170,237],"beacons":[63],"easily":[65],"found":[66],"in":[67,206,228],"shopping":[68],"centres.":[69],"Despite":[70],"the":[71,84,104],"widespread":[72,185],"of":[74,108,153,191,224,244],"APIs":[77],"their":[79,113],"potential":[80],"privacy":[82,118],"abuse,":[83],"interplay":[85],"between":[86],"commercial":[87],"mobile":[88],"SDKs":[89,157,204],"with":[90,175],"sensing":[92],"beaconing":[94],"remains":[96],"largely":[97],"unexplored.":[98],"In":[99],"this":[100],"work,":[101],"we":[102],"conduct":[103],"first":[105],"systematic":[106],"analysis":[107,124],"52":[109],"wireless-scanning":[110],"SDKs,":[111],"revealing":[112],"data":[114,163,187],"collection":[115],"practices":[116,230],"risks.":[119],"We":[120,183,221],"develop":[121],"comprehensive":[123],"pipeline":[125],"that":[126,151],"enables":[127],"us":[128],"detect":[130],"beacon":[131],"capabilities,":[133],"inject":[134],"events":[136],"trigger":[138],"app":[139],"behaviors,":[140],"monitor":[142],"runtime":[143],"execution":[144],"on":[145],"instrumented":[146],"devices.":[147],"Our":[148],"findings":[149],"show":[150],"86%":[152],"integrating":[155],"these":[156,229],"collect":[158],"at":[159],"least":[160],"one":[161],"sensitive":[162],"type,":[164],"including":[165],"device":[166],"AAID,":[172],"email,":[173],"along":[174],"GPS":[176],"coordinates,":[177],"scan":[181],"results.":[182],"uncover":[184],"SDK-to-SDK":[186],"sharing":[188],"evidence":[190,223],"ID":[192],"bridging,":[193],"where":[194],"persistent":[195],"resettable":[197],"shared":[200],"synchronized":[202],"within":[203],"embedded":[205],"applications":[207],"potentially":[209],"construct":[210],"detailed":[211],"mobility":[212],"profiles,":[213],"compromising":[214],"anonymity":[216],"long-term":[219],"tracking.":[220,254],"provide":[222],"key":[225],"actors":[226],"engaging":[227],"conclude":[232],"by":[233],"proposing":[234],"mitigation":[235],"strategies":[236],"stronger":[239],"SDK":[240],"sandboxing,":[241],"stricter":[242],"enforcement":[243],"platform":[245],"policies,":[246],"improved":[248],"transparency":[249],"mechanisms":[250],"limit":[252],"unauthorized":[253]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}