  Web communication has become an indispensable characteristic of mobile apps.
However, it is not clear what data the apps transmit, to whom, and what
consequences such transmissions have. We analyzed the web communications found
in mobile apps from the perspective of security. We first manually studied 160
Android apps to identify the commonly-used communication libraries, and to
understand how they are used in these apps. We then developed a tool to
statically identify web API URLs used in the apps, and restore the JSON data
schemas including the type and value of each parameter. We extracted 9,714
distinct web API URLs that were used in 3,376 apps. We found that developers
often use the java.net package for network communication, however, third-party
libraries like OkHttp are also used in many apps. We discovered that insecure
HTTP connections are seven times more prevalent in closed-source than in
open-source apps, and that embedded SQL and JavaScript code is used in web
communication in more than 500 different apps. This finding is devastating; it
leaves billions of users and API service providers vulnerable to attack.
