How Secure Is Your Favorite Android App?

Users of Google Android applications may be disclosing more personal information than they realize, according to a new study.

In a new report (downloadable as a PDF here), researchers from Intel Labs, Pennsylvania State University and Duke University tested 30 popular Android applications built by third-party developers. They found that 20 out of the 30 applications yielded 68 instances of the "potential misuse" of that private information.

Specifically, 15 apps reportedly sent a user's location data to advertising servers, and seven of the tested Android apps captured and transmitted device IDs, as well as phone numbers and the serial numbers of SIM cards, too.

The researchers said they used a "systemwide dynamic taint tracking and analysis system" called TaintDroid on a Google Nexus One phone running Android 2.1.

The biggest concern, the study noted, is that users aren't aware of how Android or other applications use the data they enter, even if the users can limit access to features such as location awareness.

NEXT: Google Responds

In a response from Google sent to Engadget and other news outlets Thursday, Google wrote that there's no cause for alarm and said it offers best practices to Android app developers on how to responsibly handle user data.

"On all computing devices, desktop or mobile, users necessarily entrust at least some of their information to the developer of the application," Google wrote. Android has taken steps to inform users of this trust relationship and to limit the amount of trust a user must grant to any given application developer. We also provide developers with best practices on how to handle user data."

Android apps and the Android Market have become a focus for the rapidly expanding Android ecosystem, which now boasts a small galaxy of well-regarded smartphones and other mobile devices.

Google this week also confirmed that paid applications in the Android Market will now be available in 20 additional countries.