![](bg3.png)
tificate before it is uploaded to Google Play Store
or installed on a device. Application signing sim-
plifies developers to identify the app’s author and
to update their application without administering
complicated permissions and interface. This pro-
cess also becomes an insurance policy for devel-
opers in terms of apps’ integrity and the account-
ability of their apps’ behavior thus preventing ad-
versaries from inserting malware into legitimate
apps by modifying and repackaging apps on the
apps market (SSL, 2020).
To evaluate the certificate signing mechanism
adopted by the SymptomCheckers, we extract the
CERT.RSA file among all the files generated during
the apps de-compilation via APKTool. We cus-
tomize a script leveraging Keytool (Oracle, 2020)
to obtain encryption and hashing mechanisms as
well as the length of the public key of certificates.
2. Apps’s Requested Permissions. The permission
system is a core security architecture in the An-
droid OS. All applications request permissions
to access sensitive data, system features, com-
ponents, or other sensitive resources in the op-
erating system are managed by these systems.
Once granted, apps may collaborate with a po-
tentially malicious application to perform various
attacks such as permission escalation (Melamed,
2020). In this study, we first parse Manifest.xml
of SymptomCheckers to determine the requested
permissions and to analyze any potentially dan-
gerous permissions. We then observe whether all
the available list permissions are used by the func-
tions in the respective SymptomCheckers. There-
fore, we map the API calls or methods of each app
with the permission requests in the Manifest using
AXPLORER (Backes et al., 2016). As a result, all
permission lists in the SymptomCheckers are re-
quested at least once in the API calls or methods.
3. Exported Component Analysis. Android apps
consist of several components: Activity, Service,
Content Provider, and Broadcast Receiver. These
components collaborate with each other to im-
plement and provide apps’ functionalities. Com-
monly, a function in an app will be triggered by
the user via the activity. The Android platform
allows these components to be accessed and trig-
gered from other applications by setting the ex-
ported status equal to True. However, this ex-
ported component is also a surface attack for mal-
ware to exploit an app. Melamed et al., (Melamed,
2020) demonstrates how these exported compo-
nents can manipulate apps’ components to com-
promise apps for malicious activities (CWE-926,
2020). To identify the presence of an exported
component in the SymptomCheckers, we use the
Android Drozer(F-Secure-Labs, 2020) to analyze
the Manifest file for each app. Drozer–a com-
monly used penetration testing tool–uses several
checks to exploit vulnerabilities in mobile apps.
4. Malware Detection. To detect the presence of
malicious codes in the SymptomCheckers, we
scan APKs using VirusTotal (VirusTotal, 2020).
VirusTotal is a multitude of malware scanning
tools that provide a comprehensive result by ag-
gregating more than 70 anti-virus engine and
URL/domain blacklisting services. The tools have
been widely used to identify the emergence of ma-
licious apps, executable files, application software
as well as domains. To automate the scanning pro-
cess, we take advantage of the API provided by
VirusTotal, and create a script to upload all sam-
ples to the VirusTotal repository.
5. Obfuscations Detection. Obfuscation technique
refers to any means of evading, obscuring, or dis-
rupting the analysis process by parties other than
application developers. These techniques have
both positive and negative sides. On the one hand,
this technique is useful to hardening the apps and
protecting the source code against analyzing and
reproducing. On the other hand, this technique
can be used by malware developers to evade basic
analysis layers of application distribution services
such as Google Play (Chau and Jung, 2019). Re-
search in (He et al., 2020) found that 52% of its
malware samples leverage this technique to evade
the analysis tools.
To detect such behavior in the SymptomCheck-
ers, we use APKID(RedNaga, 2016) to analyze
the .dex files obtained in decompiled APK. AP-
KID returns at least one compiler name for each
APK. If the apps leveraging any anti-analysis
technique, the APKID will return several labels
that we grouped as a manipulator, anti-virtual ma-
chine (vm), anti-debug, anti-disassembly, and ob-
fuscator.
6. Trackers Analysis. The existence of third-party
libraries and trackers on android apps has raised
privacy and security concernsThese third-party li-
braries can exchange information and infer user
personal information based on demographic data
and user behavior harvested during user interac-
tion with the apps. To reveal the existence of
these libraries, we analyze the decompiled APK
and comprehensively search sub-directories in de-
compiled APKs. These unique directories names
correspond to the libraries embedded by apps’ de-
velopers in the source codes. We rely on our list
Empirical Security and Privacy Analysis of Mobile Symptom Checking Apps on Google Play
667