LINE: Free Calls & Messages (Android / Google Play)

175x175bb (72)

This application is available for Android. This app is designed to be a ‘Swiss Army knife’ IM client. The latest build was released on July 3, 2017. Our latest check was performed on Feb 26th, 2017.

Findings Summary

Our examination revealed total 23 items, where were 10 DAR items and 13 DIT items found. Among DAR items were found 0 worst items, 10 bad items, 0 good items, and 0 best items. Among DIT items were found 1 worst item, 1 bad item, 11 good items, and 0 best items.

Below you find 3 infographics summarizing what we described above. Each image provides information about both DAR and DIT items.

 

 

This slideshow requires JavaScript.


Everything presented below is related to well-known CWEs, such as Sensitive data leakage [CWE-200], Unsafe sensitive data storage [CWE-312], Unsafe sensitive data transmission [CWE-319]. You can read more about it here.

Now let’s go deeper and examine each data item’s protection level.

 

Application Description

Let’s cite the description of this application below:

LINE reshapes communication around the globe, allowing you to enjoy not only messaging but also free voice and video calls wherever you find yourself.
Download LINE and discover the reasons for its global popularity and number one ranking in 52 countries.
LINE”s latest features

  • Intimate conversations or large round tables can happen anywhere with group video calls
    Chat with up to 200 friends in your group simultaneously! Enjoy face to face video chats with friends as well!
  • Use polls to quickly see what your friends think
    From where to meet to what to eat, avoid lengthy discussions and make decisions easily by creating a poll.

LINE”s main features

  • Free voice and video calls anywhere, anytime
    Enjoy great quality calls at no charge, no matter where you are. Even international calls with up to 200 people at the same time are completely free! Use effects and filters for even more fun during video calls. (Note that this feature may not be available on certain devices.)
  • Convenient chats where anything is possible
    Share messages, photos, videos, stickers, voice messages, and locations easily with friends.
  • Fun and easy-to-use social networking features
    From messages and photos to videos and locations, share your daily moments with friends on Timeline!
  • Find the world”s most popular characters at the Sticker Shop
    Browse hundreds of popular free stickers plus adorable stickers of the world”s favorite characters! Choose from a variety of LINE sticker sets to liven up your messages in your own unique way.
  • Auto-sync your device and PC
    Whether on the go with the mobile version or connected to the desktop version using your PC or Mac, your LINE chats are always up-to-date and synced automatically across all versions.
  • Your own personal storage space: Keep
    Store messages, photos, videos, and more in Keep where you can easily share them with friends.
  • Stay informed with LINE official accounts
    Connect directly with your favorite celebrities and companies by friending their official accounts.
  • Get connected to new apps

LINE provides a gateway to entertainment and lifestyle apps that will keep you entertained and bring new convenience to your life.

  • Make international calls with LINE Out
    Place international calls to mobile phones and landlines at low rates. You can even call friends who aren”t on LINE.
    Plus, enjoy free calls after watching ads with LINE Out Free.
  • We recommend using a data plan or connecting to Wi-Fi as you may incur data usage fees otherwise.
  • Please also use LINE with Android OS versions 4.1 and above to enjoy LINE to the fullest extent.

**********
If your network speed is too slow or you don”t have enough device storage, LINE may not install properly.
If this happens, please check your connection and try again.
**********

 

Protection levels.

Locally stored data (Data-at-Rest, DAR).

Locally stored data groups include Message Information, Address Book ‘n’ Contact Information, Application Information, Notification Information, Credentials Information, Device Information.
The average DAR value is 3.50 points (7.00 points of system protection and 0.00 points of own protection). It equals to a typical value (3.5 points, where’s 7 points of system protection and 0 points of own protection).

Items with average value 3.50 points (7 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, extra data found that shouldn’t be accessed where system protection level means – root/jailbreak is required but not possible without wiping device data, and own protection level means – stored as is.

– Media Data (‘Message Information’ Group) – Any info like images, audios, videos, media notes, etc. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Contact Short Profile (‘Address Book ‘n’ Contact Information’ Group) – Name, Email ID, Phone number of contacts. This data item related to mentioned group meant to be info locally stored, cached or transferred over the network and belong to this application if it’s social even,

– GEO Data (‘Message Information’ Group) – Any GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Messages (‘Message Information’ Group) – Different types of messages, conversations, except for SMS, MMS but including recipient and sender IDs and attachments. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Application Configs (‘Application Information’ Group) – Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be any info related to the app, app settings, including installed apps or installers,

– Application Configs (‘Notification Information’ Group) – Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be part of content delivered as notification but separate from a main in-app content,

– Credentials (IDs) (‘Notification Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be part of content delivered as notification but separate from a main in-app content,

– Credentials (IDs) (‘Credentials Information’ Group) – Only account IDs like app or 3rd party user IDs including emails, phone number, usernames, etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials including basic (IDs only), passwords, tokens, etc.,

– Device Data (‘Device Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be details about your device,

– Account Media (‘Address Book ‘n’ Contact Information’ Group) – Full or reduced image of account. This data item related to mentioned group meant to be info locally stored, cached or transferred over the network and belong to this application if it’s social even

Keep in mind if you’re using some Android devices such Samsung, LG or another device with an unlocked or non-locked loader that allow rooting your device without user action, the system level equals 6 points instead of 7. It means your data can be stolen without involving your actions.

Transferred data (Data-in-Transit, DIT).

Transferred data groups include Application Information, Message Information, Location ‘n’ Maps Information, Address Book ‘n’ Contact Information, Call Information, Device Information.
The average DIT value is 5.27 points (5.38 points of system protection and 5.15 points of own protection). It is higher than a typical value (4 points, where’s 4 points of system protection and 4 points of own protection).

Items’ GROUP #1 with average value 5.00 points (6 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data is not available all the time or partially accessed where system protection level means – MITM prevented or fake certificate importing prevented, but plaintext non-protected traffic is intercepted, and own protection level means – bypassed by fake/stolen root certificates.

– Application Configs (‘Application Information’ Group) – Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be any info related to the app, app settings, including installed apps or installers,

– Media Data (‘Message Information’ Group) – Any info like images, audios, videos, media notes, etc. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– GEO Data (‘Message Information’ Group) – Any GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Address Data (‘Message Information’ Group) – Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments

Items’ GROUP #2 with average value 6.00 points (6 points of system protection, 6 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are still possible but might involve interaction with an app code where system protection level means – MITM prevented or fake certificate importing prevented, but plaintext non-protected traffic is intercepted, and own protection level means – SSL pinning (can be patched).

– GEO Data (‘Location ‘n’ Maps Information’ Group) – Any GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any geodata from trackers, social networks, GPS, etc.,

– Address Data (‘Location ‘n’ Maps Information’ Group) – Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any geodata from trackers, social networks, GPS, etc.

Items’ GROUP #3 with average value 6.50 points (6 points of system protection, 7 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are still possible but might involve interaction with an app code where system protection level means – MITM prevented or fake certificate importing prevented, but plaintext non-protected traffic is intercepted, and own protection level means – tricks to bypass sniffing (hardly to be or can’t be patched to bypass), including non-common or unsupported protocols.

– Messages (‘Message Information’ Group) – Different types of messages, conversations, except for SMS, MMS but including recipient and sender IDs and attachments. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Contact Profile (‘Address Book ‘n’ Contact Information’ Group) – Full info about contacts including name email id, phone numbers, gender, linked accounts, geodata, stream and social activity. This data item related to mentioned group meant to be info locally stored, cached or transferred over the network and belong to this application if it’s social even,

– Contact vCard (‘Message Information’ Group) – Contact Profile info stored as vCard. This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments,

– Call Stream (‘Call Information’ Group) – Audio or Video call streaming between two or more users. This data item related to mentioned group meant to be any call info stored, cached or transferred in plain text or media files,

– Call History (‘Message Information’ Group) – Some info about calls you made like phone number, name, date and time, and type of call (missed, placed, outgoing, etc.). This data item related to mentioned group meant to be all message, including SMS, MMS, social and IM messages with or without attachments

Items’ GROUP #4 with average value 0.00 points (0 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, data ‘as is’ and easily accessed (plaintext, no protection at all) where system protection level means – transferred (or supposed to be) ‘as is’ (plaintext) due to jailbreak/root or preinstalled non-trusted firmware, certificates, etc., and own protection level means – transferred as is, perhaps protection mode turns off or doesn’t exist or info reveal eventually.

– Account Media (‘Address Book ‘n’ Contact Information’ Group) – Full or reduced image of account. This data item related to mentioned group meant to be info locally stored, cached or transferred over the network and belong to this application if it’s social even

Items’ GROUP #5 with average value 4.00 points (4 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data available if it’s allowed only and may require user action where system protection level means – informs if fake certificate imported into a device, and own protection level means – bypassed by fake/stolen root certificates.

– Device Data (‘Device Information’ Group) – Device ID, Device Name, Device OS Name and Version, and jailbroken/root status. This data item related to mentioned group meant to be details about your device

Keep in mind if you’re using out-of-date Android < 7.0, the system level equals 4 points instead of 6. It means your data can be stolen with a crafted preinstalled certificate on the device or if someone makes you install a certificate. Also, if you’re using out-of-date Android < 5.0, the system level equals 2 points instead of 4. It means your data can be stolen without involving your actions.

Privacy Policy

Full application privacy policy is available here.

You may find privacy policy details proceeding the link above to compare developer’s vision on data protection with our results.