Analyzing the user interface of Android apps

Summary

When interacting with Android apps, users may not always get what they expect. For instance, when clicking on a button labeled "upload picture", the app may actually leak the user's location while uploading photos to a cloud service. In this paper we present BACKSTAGE, a static analysis framework that binds UI elements to their corresponding callbacks, and further extracts actions in the form of Android sensitive API calls that may be triggered by events on such UI elements. We illustrate the inner workings of the analysis implemented by BACKSTAGE and then compare it against similar frameworks.