  An app user can access information of other users or third parties. We define
rogue mobile apps as those that enable a user (abuser) to access information of
another user or third party (victim), in a way that violates the victim's
privacy expectations. Such apps are dual-use and their identification is
nontrivial. We propose iRogue, an approach for identifying rogue apps based on
their reviews, posted by victims, abusers, and others. iRogue involves training
on deep learning features extracted from their 1,884 manually labeled reviews.
iRogue first identifies how alarming a review is with respect to rogue behavior
and, second, generates a rogue score for an app. iRogue predicts 100 rogue apps
from a seed dataset curated following a previous study. Also, iRogue examines
apps in other datasets of scraped reviews, and predicts an additional 139 rogue
apps. On labeled ground truth, iRogue achieves the highest recall, and
outperforms baseline approaches that leverage app descriptions and reviews. A
qualitative analysis of alarming reviews reveals rogue functionalities. App
users, platforms, and developers should be aware of such apps and their
functionalities and take measures to curb privacy risk.
