The EFF is concerned that these unique identifiers could be used to track consumer's online activity, but Tien did find some encouraging findings in the study, too. "I was kind of happy to see that there doesn't seem to be any obvious misuse of the audio video recording capacity for listening in and that sort of thing."

Enck and his fellow scientists built a program that took the Java bytecode that runs on Android phones and then decompiled it, converting it into something that humans could more easily look at and understand. In total, the researchers analyzed 21 million lines of code. Most of this work was done by computer but the Enck's team would often go in and manually inspect software that seemed interesting.

"Our analysis uncovered pervasive use/misuse of personal/phone identifiers and deep penetration of advertising and analysis networks," said the paper, which was presented this week at the in San Francisco.

The researchers call their work the "initial but not final word on Android application security."

One of the problems with this kind of analysis that the while it can show what programs are capable of doing, it doesn't prove that the Android apps are actually using their built in functionality when they are run on mobile phones.