# Sentinel: Automated Detection of Android Vishing Apps Using Optical Character Recognition
## 4 Design
### Sentry of Ventinel
#### 4.1.1 Duplicated Contacts Verification
Consequently, to compare defensive measures and address their shortcomings, we manually analyzed the Safe Voice and Call Blocker applications. #### 5.3.1 SafeVoice

The primary goal of the SafeVoice application is to verify whether the phone number has been altered during outgoing and incoming events and to notify the user accordingly [13]. The application first checks whether phone-related permissions are granted in Call Modulation and monitors for outgoing events. If an ACTION_NEW_OUTGOING_CALL event occurs, the app retrieves the phone number using EXTRA_PHONE_NUMBER, attaches a specific tag to it, and stores it in SharedPreferences. This stored phone number is then saved in the Result using getSharedPreference (tag), while the outgoing number is stored in CallModulation using getStringExtra. Finally, if a discrepancy is detected between the Result (i.e., Original Number) and the CallModulation (i.e., Outgoing Number), the application alerts the user through alert. The operational flow observed in the code presented in Listing 1. At the time of an outgoing call, SafeVoice displays EXTRA_PHONE_NUMBER alongside getStringExtra(IncomingNumber) to the user. However, this process fails to compare the number collected during the outgoing event with any other numbers before displaying it to the user, limiting its ability to detect Display Overlay Attacks that occur during incoming events. Additionally, because the values stored in SharedPreferences do not change until the next outgoing call occurs, any subsequent legitimate incoming call incorrectly be detected as tampered. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Call Screen**} & **Thema Apps** & \multicolumn{3}{c}{**Call Redirection**} & \multirow{2}{*}{**Display Overlay**} & \multirow{2}{*}{**Duplicated Contacts**} \\ \cline{2-2} \cline{4-7}  & **App 1** & & & & & & & & \\ \hline
**WhoWho**[11] & TN & TN & TN & TN & TP & TP & TP & FP \\ \hline
**PhishingEyes**[16] & TN & TN & TN & TN & FP & FP & FP & FP \\ \hline
**SmartAntiPhishing**[19] & TN & TN & TN & TN & FP & FP & FP & FP \\ \hline
**CallApp**[17] & TN & TN & TN & TN & FP & FP & FP & FP \\ \hline
**Whoscall**[15] & TN & TN & TN & TN & TP & TP & TP & FP \\ \hline
**Truecaller**[12] & TN & TN & TN & TN & TP & TP & TP & FP \\ \hline
**SafeVoice**[13] & TN & TN & TN & TN & FP, TP & FP, TP & TP & FP \\ \hline
**Call Blocker**[36] & TN & TN & TN & TN & TP & TP & TP & FP \\ \hline
**Show Caller ID \& Spam Blocker**[18] & TN & TN & TN & FP & FP & FP & FP \\ \hline
**Ventinel** & TN & TN & TN & TN & TP & TP & TP & TP \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Detection rate comparison across various applications, including Ventinel. ```
1 publicvoidonReceive(ContextcontextIntentententent){
2 if(intent.getAction()!=null){
3 oriNum=\"origPhoneNum\";
4...
5 if(intent.getAction().equals
6(\"android.intentent.action.NEW_OUTGOING_CALL\"))
7{this.prefs.edit().putString(oriNum,intent.getStringExtra
8(\"android.intent.extra.PRONE_NUMBER\")).apply();
9}
10...
11}
12 inNum=intent.getStringExtra(inNum);
13 Result=\"outgoingchanged\"+formatNum(Result)+\"to\"+formatNum(inNum);
14 SafeVoiceReceiver.number=inNum;
15 this.alert(Result,\"Callredirection\");
16}
```
Listing 1: SafeVoice detection code. #### 5.3.2 Call Blocker

The Call Blocker application aims to display the appropriate phone number to the user via a pop-up based on the current phone state [36]. To achieve this, the application checks whether the phone state (i.e., CurrentState) is RINGING or OFFHOOK using getStringExtra(state). It then retrieves the phone number with getStringExtra(IncomingNumber) and presents it to the user. This process can be observed in the code provided in Listing 2. Users verify the phone number displayed by Call Blocker in the pop-up when either an incoming or outgoing call event occurs. However, the application fails to detect any alterations or provide warnings when a manipulation takes place, making it incapable of directly identifying Display Overlay and Call Redirection Attacks.