Security and Privacy Analysis of Employee Monitoring Applications
Bibliographic record
Abstract
Workplace surveillance is not a new issue; however, recently there has been increasing adoption of Employee Monitoring Applications (EMAs) that observe employees' digital behaviour. \nThis trend was advanced by the increase of remote work due to the COVID-19 pandemic and the ease of deployment of EMAs with the accelerating cloud computing industry. \nEMAs allow employers to monitor their workers' behaviours remotely, resulting in privacy concerns. \n \nEMAs use highly privileged functions to achieve their features, such as web browsing monitoring, key-logging, microphone monitoring, webcam monitoring, and remote takeover of the device. \nEMA vendors claim to protect company security and employee privacy. \nOur research challenge is to assess how well the vendors uphold their claims of protecting security and privacy. \n \nWe develop a framework to assess security and privacy issues related to EMAs. \nOur framework applies dynamic and static analysis techniques to ten popular Windows EMAs. \nEMAs typically have a monitoring app, which is installed on an employee computer. \nThe app collects and sends data to the backend server, which aggregates the data and displays it in a dashboard. \nThe employer has access to the dashboard to view the collected data and configure monitoring settings. \n \nOur app-centred analysis is focused on issues such as insecure data transmissions, lack of certificate pinning, residual vulnerabilities after app un-installation, security vulnerabilities due to use of a proxy, anti-keylogging, conforming to Windows privacy permissions, effectiveness of EMA privacy features, and determining a general monitoring profile. \nThe app-centred analysis informs us whether EMAs are secure at the local and network levels. \nWe also assess whether EMAs uphold their promises in regards to privacy. \n \n \nOur backend analysis focuses on issues like password security, lack of input validation, open cloud storage, insufficient access control, server geolocation, and insecure security configurations like no HSTS enforcement and out-of-date TLS versions. \nAnalysing the backend infrastructure tells us on EMAs' vulnerability posture in regards to a remote attacker threat. \nWe assess whether EMA vendors adequately protect the data they collect about employees. \n \nOur analysis reveals a number of security and privacy vulnerabilities. \nThese vulnerabilities include issues like data creep, where apps collect metadata about employees and their devices, but do not display this data on the dashboard to an employer. \nWe also notice that one app does not use TLS for data transmission, so it sends private employee data over the public Internet for anyone to eavesdrop. \nOne app offers a GDPR mode, which claims to stop collecting highly sensitive data like web browsing history and screenshots. \nHowever, we see that this app still collects and sends web browsing history while this mode is turned on. \nBackend security misconfigurations we observe include open cloud storage, weak password requirements, lack of password guess rate limiting, and no HSTS enforcement. \n \nOverall, we find that each app in our analysis is vulnerable to at least one threat we assess in our framework. \nOur study aims to provide data for legal analysis to assess the need for legal protections for employees against this kind of monitoring.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.007 | 0.026 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.001 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.001 | 0.001 |
| Scholarly communication | 0.004 | 0.003 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.001 | 0.001 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".