# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 5 Low-Level Static Analysis
### Taint Analysis  
Static taint analysis, i.e., a form of information-flow analysis, has been performed with the aid of the Ostorlab tool. Typically, this type of examination can pinpoint data leakage type of problems in the examined code. This normally refers to a variety of user or other kind of input sanitisation glitches, that may facilitate intent injection, SQL injection, password tracking, or even buffer overflows. To do so, taint analysis uses a script,which tags every private data of interest, known as the source. By following each source throughout the code as a flow, the analysis may reveal every code snippet that potentially has a leakage, the so-called sink.  
After analysing all the apps, we grouped the relevant problems into three categories, namely password tracking, intent leakage, and data leakage. Regarding the first, we observed that the relevant apps used unsanitised code in their WebView login form. This issue can be exploited by an aggressor to steal any available credentials or even mount a SQL injection. On the other hand, as already mentioned in Section 5.4, intent leakage is related to three major components of the Android OS; broadcast receivers, services, and activities. Basically, properly sanitising these components in the manifest file, means less leaked intents. Lastly, data leakage has to do mainly with the usage of external storage or unsanitised data that the app receives from other apps or the system per se, and especially the WRITE_EXTERNAL_STORAGE (P12) permission, which however is employed by all but three of the apps as shown in Table 2. An important remark here is that taint analysis may produce a considerable number of false positives. Therefore, to reduce the error factor, the results of this subsection have been cross-checked with those of manifest analysis given in Section 5.4, and we kept only the intersection of the two sets based on the findings of taint analysis. Overall, an approximately 55% of the taint analysis results were found to be common between the two sets.  
The results of applying taint analysis to each of the available apps are illustrated in Figure 3. The numbers inside the stacked bars designate the quantity of the issues that fall under the same category per app. As observed, the two-thirds (20) of the examined apps were found to be prone to at least one of the categories of the problems pertaining to this type of analysis. Specifically, all of these apps but three present at least one issue that is classified as data leakage, nine of them issues that belong to the intent leakage category, and only two that exhibit password tracking issues. Last but not least, a straightforward observation is that apps that belong to the same automotive group present the same issues more or less. For instance, all apps destined to the BMW group demonstrate the same distribution of issues across the same categories. The same situation applies to the PSA and TATA groups, and also partially to the VW one.  
Figure 3: Issues identified through taint analysis. The numbers inside the bars designate the amount of issues per category.