Automatic identification of applications that circumvent permissions and/or obfuscate data flows

A set of one or more non-transitory machine-readable storage media storing instructions which, when executed by one or more processors of a set of computing devices, causes the set of computing devices to perform operations for identifying applications that circumvent permissions, the operations comprising:

• accessing a network traffic log that includes information regarding network traffic transmitted by one or more computing devices while the one or more computing devices were executing one or more applications;
• identifying, based on analyzing the network traffic log and permissions granted to the one or more applications, those of the one or more applications that caused permission-protected data to be transmitted without having permission to access that data as circumventing permissions, wherein the permissions granted to the one or more applications include permissions for the one or more applications to access certain types of data stored in the one or more computing devices;
• decompiling an application to generate decompiled code of the application;
• searching for a fingerprint in the decompiled code of the application, wherein the fingerprint was generated based on reverse engineering one of the applications that were identified as circumventing permissions;
• determining that the application is capable of circumventing permissions in response to finding the fingerprint in the decompiled code of the application;
• and
• generating a report indicating the applications that were identified as circumventing permissions and indicating that the application is capable of circumventing permissions.

A computing device configured to identify applications that circumvent permissions, the computing device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the computing device to:
• access a network traffic log that includes information regarding network traffic transmitted by one or more computing devices while the one or more computing devices were executing one or more applications,
• identify, based on analyzing the network traffic log and permissions granted to the one or more applications, those of the one or more applications that caused permission-protected data to be transmitted without having permission to access that data as circumventing permissions, wherein the permissions granted to the one or more applications include permissions for the one or more applications to access certain types of data stored in the one or more computing devices,
• decompile an application to generate decompiled code of the application,
• search for a fingerprint in the decompiled code of the application, wherein the fingerprint was generated based on reverse engineering one of the applications that were identified as circumventing permissions,
• determine that the application is capable of circumventing permissions in response to finding the fingerprint in the decompiled code of the application, and
• generate a report indicating the applications that were identified as circumventing permissions and indicating that the application is capable of circumventing permissions.