GeoTwins: Uncovering Hidden Geographic Disparities in Android Apps
- Proceedings of the 24th Annual International Conference on Mobile Systems, Applications and Services : 83-95
Résumé
While mobile app evolution over time has been extensively studied, geographical variation in app behavior remains largely unexplored. This paper presents a large-scale study of location-based Android app differentiation, uncovering two underexplored phenomena with significant security and fairness implications.
First, we introduce the concept of GeoTwins: apps that are functionally similar and share branding, yet are released under different package names (i.e., as two separate apps) across different countries. We investigate whether these seemingly identical apps diverge in critical aspects such as requested permissions, third-party libraries, code (i.e., smali files), and privacy disclosures. Second, we investigate the Android App Bundle ecosystem and examine whether supposedly consistent base.apk files remain invariant across regions, or if hidden regional customization exists that may affect app behavior or security.
To analyze these phenomena, we developed a distributed app collection pipeline spanning multiple regions and analyzed thousands of apps. We also release our dataset of 81 963 GeoTwins to facilitate further research. Our analysis reveals that around 20% of GeoTwin pairs exhibit meaningful differences, with the largest discrepancies occurring in the code, as well as in permissions, third-party libraries, and privacy disclosures. Furthermore, we find that nearly one in ten apps (8.6%) with the same package name exhibit significant cross-region differences in their base.apk, despite expectations of consistency.
These discrepancies have concrete consequences for researchers, developers, and regulators. As geographically distinct app variants can differ in their base.apk, the same app may be considered benign in one malware detection research study but potentially malicious in another, depending on where it was downloaded. At the same time, GeoTwins raise concerns about transparency and geographical fairness, as visually identical apps may differ in permissions, libraries, or privacy disclosures without users being aware.
Mots-clés
permissions, libraries, or privacy