Application privacy scanning systems and related methods

A non-transitory computer-readable medium storing computer-executable instructions for performing static mobile application privacy analysis, the computer-executable instructions comprising instructions for:

• receiving, by one or more computer processors, identifying information for a mobile device application;
• obtaining, by the one or more computer processors, based at least in part on the identifying information, the mobile device application;
• querying, by the one or more computer processors, using the identifying information, a database of application characteristics for an identifier of a software development kit used to generate the mobile device application;
• receiving, by the one or more computer processors, from the database of application characteristics, a response comprising the identifier of the software development kit used to generate the mobile device application;
• obtaining, by the one or more computer processors, the software development kit used to generate the mobile device application based at least in part on the identifier of the software development kit used to generate the mobile device application;
• decompiling, by the one or more computer processors, the mobile device application to generate a decompiled mobile device application based at least in part on the software development kit used to generate the mobile device application;
• analyzing, by the one or more computer processors, the decompiled mobile device application to determine one or more data types referenced by the mobile device application;
• determining, by the one or more computer processors, that the one or more data types comprise personal data;
• at least partially in response to analyzing the decompiled mobile device application, determining, by the one or more computer processors, to perform dynamic privacy analysis of the mobile device application;
• responsive to determining to perform the dynamic privacy analysis of the mobile device application, setting, by the one or more computer processors, a dynamic privacy analysis indicator;
• determining, by the one or more computer processors, a privacy risk score based at least in part on the response to the database query and the one or more data types referenced by the mobile device application;
• and
• storing, by the one or more computer processors, the privacy risk score and the one or more data types referenced by mobile device application.

A mobile device application static privacy analysis system comprising:

• one or more computer processors;
• and
• a computer memory storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
• receiving a request to perform static privacy analysis of a mobile device application, the request comprising an identifier of the mobile device application;
• at least partially in response to receiving the request, obtaining the mobile device application from an application developer system using the identifier of the mobile device application;
• at least partially in response to receiving the request, querying a database of software development kit information using the identifier of the mobile device application for one or more privacy attributes associated with the mobile device application;
• receiving a response to the database query comprising the one or more privacy attributes associated with the mobile device application;
• decompiling the mobile device application to generate a decompiled mobile device application based at least in part on the one or more privacy attributes associated with the mobile device application;
• analyzing the decompiled mobile device application to determine one or more data types referenced by the decompiled mobile device application;
• determining that the one or more data types comprise personal data;
• at least partially in response to analyzing the decompiled mobile device application and the one or more privacy attributes associated with the mobile device application, determining to perform dynamic privacy analysis of the mobile device application;
• responsive to determining to perform the dynamic privacy analysis of the mobile device application, setting a dynamic privacy analysis indicator;
• determining a privacy risk score based at least in part on the one or more privacy attributes associated with the mobile device application and the one or more data types referenced by the decompiled mobile device application;
• and
• storing the privacy risk score, the one or more privacy attributes associated with the mobile device application, and the one or more data types referenced by the decompiled mobile device application.