Google Play Apps

Login scenario

Distribution of API levels

We downloaded top 100 apps from each of the 58 free app categories in the Canadian Google Play Store as of December 2019, arriving at 5,569 apps. We listed the distribution of API levels of these Google Play apps in the following table.

We did not find any app of API level 6 or below, thus these API levels are omitted in the following table. In addition, there are 14 apps that we cannot extract the API levels.

The first step of our Google Play apps selection is to keep apps of API level 25 or below. This selection resulted in 188 apps.

Login Identification

After retriving the API level of each app, we kept apps of API level 25 or below. This selection resulted in 188 apps. We then executed every app on a device for 20 minutes, and check whether the app contains any authentication functionality. We confirmed reliable authentication mechanism in 51 out of 188 apps.

In this section, we listed all 51 apps with reliable authentication mechanism. We also provide what type of login functionality we identified from each app.

The following table consists of these columns:

• APILevel: The API level of an app. We sorted all the apps by their API levels, from the smallest one to the largest one.
• AppName: The full package name of the app.
• Category: On Google Play Store, apps are categorized into 58 categories, e.g., AUTO_AND_VEHICLES, BOOKS_AND_REFERENCE. We listed the category of an app on Google Play Store in this column. An app may from multiple categories, e.g., com.facebook.katana from both APPLICATION and SOCIAL categories. We confirmed that the APKs from different categories with the same app name are identical.
• LoginType: What type of login functionality we identified from each app. There are mainly two types of login:
  • Traditional: Login functionality is not delegated to third-party OAuth service providers.
  • OAuth (including Google Sign In, Facebook Login and Weibo): Login functionality is delegated to third-party OAuth service providers.
• Included/Excluded: Whether we included or excluded an app. For apps that are excluded, we also provided the reason in parentheses.

Our final app selection consists of 20 Google Play apps.

Sources and sinks

We provided the list of sources and sinks we used for login-related Google Play apps (SS-GPL) in Section 3.4.2 (Table 6) of our paper.

Spyware scenario

Sources and sinks

We provided the list of sources and sinks we used for spyware Google Play apps (SS-GPS) in Section 3.4.2 (Table 7) of our paper.

Overall selected apps and expected results

This section contains (1) a package contains 26 Google Play apps (login-related and spyware) that we used in our study and details of expected flows (2) a table with information of these Google Play apps that we used in our study and the number of expected flows (ground truth) we identified.

All selected apps and the corresponding expected results can be downloaded here. To compress the size of this package, We did not include the decompiled source code of each app. However, the decompiled tool Jadx v1.0.0 is provided here.

Expected results are stored in docx files, where we highlighted the source and sink methods as well as which variables is tainted in each statement. For example, for the following code snippet:

1  package ubc.junbin;
2  class clz {
3    String a = source(); // source
4    String b = a;
5    sink(b); // sink
6  }

We presents the expected results as:

// expected source and sink are put at the top of a flow
Expected source: source()
Expected sink: sink()

> ubc.junbin.clz: // the class to locate statements
L3: String a = source();
L4: String b = a;
L5: sink(b);

We also provide a set of csv files that can be easily parsed automatically. Each csv file contains an expected flow. For example, for the above code snippit, the csv file may look like the following. The name of Class, LineID, and Line are extracted using Soot v3.3.0.

The following table detailedly presents information of these 26 selected apps, which consists of these columns:

• APILevel: The API level of an app. We sorted all the apps by their API levels, from the smallest one to the largest one.
• AppID: We numbered all Google Play apps we used, from 1 to 26, obeying the order of “APILevel”.
• AppName: The full package name of the app.
• Number of component(s): The number of Android components declared in the manifest file of an app.
• Number of expected flow(s): The number of expected flows.

Sources of failures

Our analysis results can be downloaded here. Our manual inspection results about sources of failures on Google Play apps (both login-related ones and spyware) can be found in Section 5.3 (Table 12) of our paper.

Execution time and memory consumption

In the following table, we detailedly list the execution time (in minutes) of each tool on Google Play apps.

The following table consists of these columns:

• AppID and AppName: These two columns are information of benchmarks, matching AppID, and AppName in Overall selected apps and expected results¶ table.
• The left columns are all about results of studied tools. We list details about the execution time of each tool.

In the following table, we detailedly list the memory consumption (in MBs) of each tool on Google Play apps. The below table also consists of two main parts, similar to the above table for execution time, while the second part is with memory consumption.