Comparison

1. Comparison with FlowDroid and IccTA.

FlowDroid/IccTA only outputs suspicious data-leakage flows without specifying the specific data type, thus yields a large number of non-sensitive data-related issues such as debugging output (i.e., Log Data Leakage and SD Card Data Lekage), and redundant sources (i.e., the following example of SMS Data Leakage), which requires substantial manual effort to verify it.

Specifically, for the 4 types of data leakage of GCash, 13 types of sensitive data are detected by Ausera (i.e., 3 Logging Data Leakage, 7 SD Card Data Leakage, 1 SMS Data Leakage, and 0 SharedPreference Data Leakage), however, FlowDroid/IccTA outputs 73 leakages, thus yields 62 false positives through manual cross-validation by co-authors.

SMS Data Leakage/SharedPreference Data Leakage:

Found a flow to sink virtualinvoke $r10.<android.telephony.SmsManager: void sendTextMessage(java.lang.String,java.lang.String,java.lang.String,android.app.PendingIntent,android.app.PendingIntent)>($r1, null, $r2, $r6, $r7), from the following sources:

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.transaction.RegistrationTransactionActivity: void doNext()>)

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.transaction.RegistrationTransactionActivity: void doNext()>)

***Note that we cannot know the data type of variable $r4 only relying on the data-leakage flow.

***Actually, the five sources are the redundant sources if there is no concrete data type.

***The comparison results of Ausera can be referred at https://sites.google.com/view/ausera/homepage/demo

Found a flow to sink interfaceinvoke $r16.<android.content.SharedPreferences$Editor: android.content.SharedPreferences$Editor putLong(java.lang.String,long)>($r8, $l0), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.facebook.BrowseFacebookFriendsListActivity: void onActivityResult(int,int,android.content.Intent)>)

Logging Data Leakage/SD Card Data Leakage:

Note that all of the data are exposed by Log function, however, most of them are non-sensitive data according to our manual analysis.

Found a flow to sink staticinvoke <android.util.Log: int v(java.lang.String,java.lang.String)>($r2, $r1), from the following sources:

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.transaction.RegistrationTransactionActivity: void doNext()>)

Found a flow to sink staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("RECEIVED", $r6), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.paybills.PayBillsTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("REGEX", $r2), from the following sources:

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.sendmoney.SendGcashMobileFieldsActivity: void onClickAction1(android.view.View)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.buyload.BuyLoadTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("GCashActivity", $r4), from the following sources:

- $r1 = virtualinvoke $r0.<com.globe.gcash.android.activity.dashboard.DashboardFragmentActivity: android.view.View findViewById(int)>(2131165456) (in <com.globe.gcash.android.activity.dashboard.DashboardFragmentActivity: void setActionBarIcon()>)

Found a flow to sink staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("RESULT", $r5), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.paybills.BillersActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("GCashUtils", $r3), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.buyload.BuyLoadTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("GCashActivity", $r7), from the following sources:

- $r2 = specialinvoke $r0.<roboguice.activity.RoboFragmentActivity: android.view.View findViewById(int)>($i0) (in <com.jeremyfeinstein.slidingmenu.lib.app.SlidingFragmentActivity: android.view.View findViewById(int)>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("GCashActivity", $r6), from the following sources:

- $r1 = virtualinvoke $r0.<com.globe.gcash.android.activity.GcashActivity: android.view.View findViewById(int)>(2131165456) (in <com.globe.gcash.android.activity.GcashActivity: void setActionBarIcon()>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("Form Validator", $r3), from the following sources:

- $r2 = virtualinvoke $r1.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.form.validator.FormValidator: boolean validateEditTextsDigitsIfExceedsRange(int,int,android.widget.EditText[])>)

Found a flow to sink staticinvoke <android.util.Log: int i(java.lang.String,java.lang.String)>("REGEX", $r2), from the following sources:

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.sendmoney.SendGcashMobileFieldsActivity: void onClickAction1(android.view.View)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.buyload.BuyLoadTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int v(java.lang.String,java.lang.String)>("SMS: REGISTER##", $r4), from the following sources:

- $r5 = virtualinvoke $r4.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.transaction.RegistrationTransactionActivity: void doNext()>)

Found a flow to sink staticinvoke <android.util.Log: int w(java.lang.String,java.lang.String)>($r10, $r9), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.facebook.BrowseFacebookFriendsListActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>("RECEIVED", $r6), from the following sources:

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.donate.DonateTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink staticinvoke <android.util.Log: int d(java.lang.String,java.lang.String)>($r0, $r1), from the following sources:

- $i1 := @parameter1: int (in <com.globe.gcash.android.activity.buyload.BuyLoadTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $i1 := @parameter1: int (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $i0 := @parameter0: int (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

- $r1 := @parameter2: android.content.Intent (in <com.globe.gcash.android.activity.transaction.SendMoneyTransactionActivity: void onActivityResult(int,int,android.content.Intent)>)

Found a flow to sink virtualinvoke $r2.<java.io.Writer: void write(int)>($c3), from the following sources:

- $r15 = virtualinvoke $r14.<android.widget.EditText: android.text.Editable getText()>() (in <com.globe.gcash.android.activity.paybills.PayBirTransactionActivity: void doNext()>)