APPLADroid: Automaton Based Inter-app Privacy Leak Analysis for Android

An app named “Aqua Mail” is a Google play store app with millions of downloads. It allows the user to manage Google account mails. For caching purposes, it stores the mails in a content provider protected with a custom permission rather than Android defined permission to access mails (MANAGE_ACCOUNTS). Another app named “Enhanced SMS and call” can access mails directly by obtaining the permission of reading the custom content provider of Aqua Mail. Google is not aware of the fact that any other app is accessing the mails. In order to detect such flows, a precise inter-app analysis is needed to identify leakage from source in one app to sink in another app.