dataset · Zenodo (CERN European Organization for Nuclear Research)
A study examined repeated permission declarations in 84 current Android finance applications to evaluate manifest integrity verification schemes. Cryptographic schemes that commit to an application's declared permissions require both the client and the verifier to derive identical leaves from the same manifest. The accompanying dataset captures permissions read directly from binary manifests without intermediate text decoders, measuring leaf counts across six string-canonicalisation policies and contrasting set versus sequence semantics. Across the analysed applications, the data records 21 application-permission pairs with repeated declarations, representing 14 distinct permissions. The package includes multiset and sequence comparisons using an independent tool, test runs of an unmodified reference verifier across 1,000 iterations, and benchmark evaluations of specific commercial financial applications.
Cryptographic verification ensures that mobile applications run with the exact permissions intended, preventing unauthorised privilege escalation. When security systems and app manifests handle repeated declarations or text canonicalisation inconsistently, integrity checks can fail. Clear rules for leaf derivation help security engineers and platform maintainers ensure that verification protocols work reliably across real-world financial software.
The dataset and verification tests directly inform developers of mobile app security tools, app-store integrity platforms, and cryptographic verification protocols. As an applied empirical study with an accompanying reference verifier test suite, the work sits at the applied research stage. It provides concrete specifications and testing data for software security vendors seeking to implement robust manifest verification in high-risk categories such as mobile banking.
AI-generated from the published abstract. Always read the original work before citing.
Data and code supporting the paper “Repeated Permission Declarations in Android Finance-Category Applications: A Prevalence Study of Under-Specified Leaf Derivation in Manifest Integrity Verification” (Alsaedy, Ghalwash, Yousif, Azzam; submitted to Automated Software Engineering, 2026). A cryptographic scheme that commits to an application’s declared permissions is correct only when the client and the verifier derive the same leaves from the same manifest. This deposit contains the measurement behind the paper: 84 current Android finance-category applications, scanned by reading permissions directly from the binary manifest with no text decoder in the extraction path, and the leaf counts each manifest yields under six string-canonicalisation policies and under set versus sequence semantics. The archive contains: S1 — one row per application: package, versionCode, SHA-256, declaration count, exact-duplicate count, and the leaf count under each policy with its delta; S2 — every application-permission pair where a name is declared more than once (21 pairs over 14 distinct permissions); S3 — for each of those pairs, whether the repeated elements are identical and whether any attribute beyond android:name is present; S4 — an independent extraction of all 84 packages with Apktool 3.0.3, compared as ordered lists, as multisets, and on every repeat count; S5 — the run of the unmodified E-AAPIV reference verifier against an affected application, over 1,000 iterations; S6 to S8 — the positive controls, PayPal 8.97.0 and Venmo 26.6.0, plus PayPal 10.10.0 for the temporal comparison; the extraction, measurement and cross-check code, and the reference verifier. The application packages themselves are not redistributed, because their publishers restrict redistribution. Every reported result depends only on the manifest, and each row of S1 carries the SHA-256 of the package that produced it, so the extraction can be confirmed against the same builds. A README inside the archive documents each file, states which claim in the paper comes from which file, and gives the corpus sampling rule.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.5281/zenodo.22648080
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
