1    Introduction

CyanogenMod is an Android distribution aiming to provide more customizable experience to Android users. Recently, they added a new integrated end-to-end encrypted feature called CyanogenMod Account which helps users find their misplaced phone or securely wipe their data in the case of lost phones.

Nowadays, there exist lots of applications on Android market that support these func- tionalities. They usually request permissions to user locations before installation and users never know what these applications actually do with their location information once the permissions are given.

The creators of CyanogenMod Account, however, stated that they would never sell the data or track/wipe the device illegally. Is this true?

2    Objective

In this project, we want to see if CyanogenMod Account obeys their private policies. Specifically, we check the following aspects:

• The actual location is not sent to or stored on their servers;
• Location information is always encrypted before it is sent to the servers;
• The protocol makes sure that the user himself is the only one who can track/wipe his device.

3    Methods

Basically, we want to use two methods – static analysis and dynamic verification.