The objective of this project is to shed light on the Android supply chain and explore the attribution, privacy and security aspects of this ecosystem. Specifically, IMDEA Networks aims to improve already existing analysis tools to study the privacy risks of custom permissions exposed by pre-installed components and for identifying the supply chain of developers able to pre-install software on Android devices, even if dynamically through the use of Firmware-over-the-air (FOTA) components. The tools and data will be made publicly available to the research community.

This research contract was received as a Fellowship awarded to the researcher Julien Gamba.