# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 5 Low-Level Static Analysis
### Tracker Analysis  
This subsection is devoted to third-party trackers that may be utilised by each app. Specifically, MobSF uses the open source Exodus-Privacy [67] webapp to analyse any detected tracker in the app's source code. The focus is on six diverse tracker categories. The first one is \"crash reporters\". Such a tracker concentrates on the crashes that may occur during the normal operation of the app. Upon a crash event, they send a notification message to the developers, informing them about the respective error. The next category is referred to as \"analytics\". They gather all possible information regarding the usage of the app by the users, say, the time each user spent in the app, which features they used, and so on. On the other hand, the main purpose of \"profiling\" type of trackers is to gather multiple information regarding the user. Then, they attempt to profile the user with the aim of achieving and optimising personalised advertising. Another category of trackers is referred to as \"identification\". These can use the gathered information with the purpose of ultimately matching a digital (user) identity with the real person. The penultimate category of trackers is \"ads\". These trackers are specialised in serving personalised advertisements to the users. The last category is referred to as \"location\". By using location services along with the data provided by different sensors of the mobile device, the app, and subsequently the trackers, can obtain the geographical location of the user. After that, the user can be targeted with location-based ads. For details about the third-party trackers issue in the mobile ecosystem, the interested reader can refer to the works in [68; 69; 70]. App analysis revealed that 30 apps use at least Firebase or other Google analytics service as a method to measure users' engagement with them. Given that Google analytics can be considered as the price floor in third-party tracking, all eight apps which only embrace this type of trackers or no tracker at all (Porsche Connect) are reported to have zero trackers in Table 6. Nevertheless, we did not treat the same way third-party crash reporters, because it has been observed that they were used along with analytics, which monitor the user's behavior. Details on the 24 unique third-party trackers used by these apps are given in the following. Moreover, Table 6 sets out the distribution of these trackers per app. * T1: _AltBeacon_[71] is a specification and open-source library for proximity beacon implementations. It is used to notify the app when a BLE beacon appears or disappears. Furthermore, it may allow Android devices to transmit beacons in the background. Exodus did not provide any category for this tracker. Nevertheless, through beaconing and geofencing technologies, an app can possibly acquire the location of users and target them with location-based ads [72]. So, we categorise this tracker as a location one. * T2: _Apdynamics_[73] is a platform that enables one to monitor and analyse mobile device data. Exodus categorised this tracker as an analytics and profiling one. * T3: _Branch_[74] is a mobile measurement and deep linking platform. According to Exodus, this tracker is categorised as analytics. However, among others, Branch collects the IP address of the device, and its fingerprint, including identity ID, hardware ID, brand, model, screen DPI and height. * T4: _LeanPlum_[75] is self-defined as a multi-channel customer engagement platform. Based on the Exodus output, LeanPlum is able to use messaging, mobile automation of marketing, app personalization, A/B testing (also known as split testing), and analytics. Based on this, Exodus classifies Leanplum as an analytics, location, and profiling tracker. Furthermore, the privacy policy contained in the LeanPlum website is not clear on whether it also applies to their mobile tracker or not. Namely, the provided policy mentions that they can perform data sharing, do a third-party data collection, and gather personal information.