• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Android permissions explained, security tips, and avoiding malware

nmbs said:

I am looking to upgrade to a new android phone but I am hesitant to get a phone with many pre-loaded apps that you cannot remove. Those apps also have permissions, since they are already loaded on to the phone does that mean that if i inadvertently click on one i have given that app access to the permissions it is requesting?
Click to expand...

Yes, if the app requires those permission to be able to run, then if you launch the app, it will request the system to use those permissions. As the app is already installed on the phone, the system takes it that the user has granted this permission ('installing said app).

There are two ways to get a phone to come with minimal bloatwares. You can buy a Google Nexus Phone (Nexus One, Nexus S, and soon to be Nexus Prime) or buy an UNBRANDED Android phone. An Unbranded phone is made directly by the OEM with no carrier interference. These phones are usually (carrier) unlock as well but you end up paying a premium for it being that way.
 
You know what ALP? Your thread has turned a lot of lurkers into members!!! I just realized that a lot of the people that post in here are new members. Now you need to talk to Phases about upping your commission ;)
 
nmbs said:
First thank you for the post, it is really helpful. Second my question...

I am looking to upgrade to a new android phone but I am hesitant to get a phone with many pre-loaded apps that you cannot remove. Those apps also have permissions, since they are already loaded on to the phone does that mean that if i inadvertently click on one i have given that app access to the permissions it is requesting?

I tried looking for information on this in other forums but the concern with bloatware is mostly about memory space and processing time not permissions.

I know you can root your phone to remove these apps but I don't really want to do that.
Click to expand...


Thanks for the kind words :)

As for bloatware, you are correct: once it runs it can use those permissions.

One way to check permissions for any already-installed app would be with my app PocketPermissions. This will just allow you to see what apps have asked for a particular permission, but it includes system apps and bloatware, so you can get the complete picture.



forum thread: http://androidforums.com/android-ap...ermissions-app-version-my-security-guide.html

market link: https://market.android.com/details?id=com.alostpacket.pocketpermissions
Click to expand...
Rooting and removing or "freezing" the app is one way to avoid the problem.

Another possible solution would be to use a custom Home Screen Launcher like Launcher Pro. There is a setting in there that will allow you to "hide" unwanted apps from the app drawer. It's one of my favorite features of Launcher Pro. Other launchers probably also have this feature too.

And the other way is (as Roze said) to buy Nexus or an unbranded phone (which means paying full price -- usually $500ish but it equals out in the end because you can sometimes save money on any cell plan you get). I left Verizon and paid a huge ETF because of a computer mix up but ended up saving money in the end even though I paid $530 for my Nexus 1. T-mobile was that much cheaper at the time.


Hope that helps and welcome to the forums

:)
 
Roze said:
You know what ALP? Your thread has turned a lot of lurkers into members!!! I just realized that a lot of the people that post in here are new members. Now you need to talk to Phases about upping your commission ;)
Click to expand...


Heh I wish. I'm hoping they will run a story on one of my apps someday at least. That would be quite a thank you :D

Maybe when I release this next round of updates with tablet optimization I'll send them a quick note :)
 
alostpacket said:
And the other way is (as Roze said) to buy Nexus or an unbranded phone (which means paying full price -- usually $500ish but it equals out in the end because you can sometimes save money on any cell plan you get). I left Verizon and paid a huge ETF because of a computer mix up but ended up saving money in the end even though I paid $530 for my Nexus 1. T-mobile was that much cheaper at the time.
Click to expand...

Sorry ALP, just some clarification. Unbranded phones in US/Canada cost upward of $700(US) or $800(CAD) and unbranded phones in the UK is around
 
Like others on this thread, I'm a complete novice to android (and to smartphones entirely actually- I haven't actually owned a cell phone in years). However, I recently purchased a Samsung Galaxy S2 and am working on getting up to speed (talk about zero to 60!). I've found this forum post to be particularly helpful, and PocketPermissions was my first purchase from the Market :D. It's terrific, and many kudos to alostpacket!

If I had one suggestion for something that would make it even better- I'd love to have a little note with each permission saying what other permissions are likely to be requested in combination with it, and which should be red flags- for example, the read calendar data entry could have a warning saying to pay extra attention when this permission is requested in conjunction with full internet access (and maybe not so much if it's the only permission). Or maybe a different little section with a paragraph on particularly notable concerning combinations of permissions (perhaps I'm still just finding all of them a little overwhelming!)

I had a few specific questions I'd love some feedback on:

1. What is the 'billing' permission? I'm gathering it has to do with the in-app billing possibility for app developers that allows consumers to make purchases using their google checkout accounts from within the app itself rather than having to launch the market app, but what does this permission actually do- does it give the app the ability to initiate this process on it's own? If the app has no permission to access the internet, manage credentials or accounts, etc., then what can it do with that permission? I've got the simple calendar app which in its latest update has added a donate button that needs this permission (just for context).

2. When an app requests permission to manage accounts or use credentials, does that only apply to the given application, or to all stored accounts and credentials on the phone? E.g. if I give these permissions to the UTube app, does that mean it can impersonate me on Utube, or does that mean it could also (theoretically of course), impersonate me on facebook, gmail, heck, my bank....? What if I don
 
Welcome to AF MiscBec! :)

What good questions! And I'm very glad you liked PocketPermissions - thank you very much for the kind words :D (As always please feel free to rate/comment on it in the market). We're always glad to have some feedback.

If it's OK also, I'm going to post a quick note in the PocketPermissions thread with your suggestions so others can see them and I will remember to try and implement them :)

1) Billing permission - I hadn't seen this actually but I'm pretty sure that's what it is for. I will add it to the list. I am pretty sure that Google puts in some extra safeguards for that permission too. I think you are able to set a PIN code to protect your saved credit card, and that an app must still go through an extra screen asking you if it is ok to purchase that item. I will be sure to double check this with an live demo app to see for sure and post back the results.

Once the app gets an OK to charge you I believe it has a short window (10 or 15 mins) in which to charge you. After that, It must re-request your OK.

Like I said though this is just some of what I have read and heard, I will test this for sure myself as soon as time permits :)

2) Manage Accounts / Use credentials

When an app request to manage accounts or use credentials on your phone, it only means accounts that have been set up as Android accounts on the phone. Typically this would almost never include your bank. Rather it includes your Google account (gmail) and any services that you can access through that account. Other accounts that are setup through the phone are Facebook, Twitter, Picassa, etc.

Generally this permission is not as scary as it sounds but you should take caution in granting it.

Manage accounts would allow an app to add or delete (possibly modify) an account. However I think there are some safeguards about modifying any accounts.

Typically the only apps that need to manage accounts would be apps that want to create a special account for you (like twitter or Facebook).

To see what accounts you have on your phone, From the phone's home screen press [menu] > settings > accounts & sync

When an app requests that it be allowed to use credentials, this typically would not give it access to your password or anything like that. Rather, it allows the app to interact with that account on your behalf. For example, an app that helps you backup gmail, may request this permission, so that it can access the data from gmail. This does it it some extra access to other services like YouTube and other Google services, but usually to nothing more sensitive than your gmail. This would not give it a way to log into your bank account.

Again though, this is another permission that should be given with caution. Some apps may request this to interact with Google services, however, I'm hesitant to grant it too easily. I typically would only grant it to Google apps themselves and rarely some type of "replacement" app or social app.

3) Number of Downloads & Ratings

This is very subjective unfortunately. The section on "The Community" in the guide and in PocketPermissions covers this to some extent. But you bring up some important points too :)

Basically it is all about context (as with everything). It is important to remember that some of the most nefarious and malicious apps will pay people to fake reviews and fake downloads (this was the case with an illegal 'free music' download app a few months ago).

If you don't want to feel too brave, I'd at least wait until an app had about 100 downloads. Maybe 500. Lots of the best apps start off small (for reference, PocketPermissions still has less than 100).

A better way to tell would be to look at what the comments say. Are they very general, like a horoscope? Saying things like "best app!" "would download again A+++" Or, are they more specific "I like feature X and have a minor problem with Y, 4 stars until Y is fixed - -Samsung Galaxy S"

It is also pretty normal for a dev to have a few friends comment on an app and give it good ratings. But this is usually just one or a handful of reviews and not considered bad/gaming the system.

But none of these methods are perfect for detecting ill intent alone. They must be used together to form a complete picture.


Anyways, hope that helps, and thanks again for the kind words,

cheers :)

-alp
 
I've just got a Galaxy s2, opened Samsung Apps, which is telling me that an update is available. It then asks that 'This is a system application. Do you still want to replace it?'

However, it then states several permissions that I must allow the app to have, some are listed here, but the one that really concerns me I believe was under 'Services that cost you money':
'make phone calls directly'

WTF?!

I bought a Samsung as I hate the way Apple force you to do things, but Apple is a joy compaired to Samsung and Android, jeez, I downloaded We City and, without asking, it searched my contacts to find my friends who were also part of the network, so they now have my friends details too!!!!

I'm off to talk to the Data Commisioner.
 
Ginola said:
I've just got a Galaxy s2, opened Samsung Apps, which is telling me that an update is available. It then asks that 'This is a system application. Do you still want to replace it?'

However, it then states several permissions that I must allow the app to have, some are listed here, but the one that really concerns me I believe was under 'Services that cost you money':
'make phone calls directly'

WTF?!

I bought a Samsung as I hate the way Apple force you to do things, but Apple is a joy compaired to Samsung and Android, jeez, I downloaded We City and, without asking, it searched my contacts to find my friends who were also part of the network, so they now have my friends details too!!!!

I'm off to talk to the Data Commisioner.
Click to expand...

What were the system apps that asked to be updated.

You just need to be wise when downloading app. Ask yourself if that app requires those permissions. A contact replacement app will ask you for the 'permission to read/write contact data' and 'make phone call that will cost you money' and 'read/send sms that will cost you money'. As you're replacing the full contact app, it needs these permissions to function. Now you look at the developer and see what type of company/person it/he is. Read the reviews and see what members are saying.

Some games will ask you for contact info. These are usually ones that allow you to play the same game with one of your friends (from your contact list). I don't download such games :/
 
Ginola said:
I've just got a Galaxy s2, opened Samsung Apps, which is telling me that an update is available. It then asks that 'This is a system application. Do you still want to replace it?'

However, it then states several permissions that I must allow the app to have, some are listed here, but the one that really concerns me I believe was under 'Services that cost you money':
'make phone calls directly'

WTF?!

I bought a Samsung as I hate the way Apple force you to do things, but Apple is a joy compaired to Samsung and Android, jeez, I downloaded We City and, without asking, it searched my contacts to find my friends who were also part of the network, so they now have my friends details too!!!!

I'm off to talk to the Data Commisioner.
Click to expand...


That permission is the same as this one:

warningcomicalbombsmall.png
Make phone calls
Services that cost you money

This permission is of moderate to high importance. This could let an application call a 1-900 number and charge you money. However, this is not as common a way to cheat people in today's world as it used to be. Legitimate applications that use this include: Google Voice and Google Maps.

Another important point to note here is that any app can launch the phone screen and pre-fill a number for you. However, in order to make the call, you would need to press [Send] or [Call] yourself. The difference with this permission is that an app could make the entire process automatic and hidden.
Click to expand...
I wouldn't worry too much if it's a Samsung app. Roze hit the nail on the head. It's all about context. Many system apps will require tons of permissions to function correctly, they probably should not be seen in the same light/context as a 3rd party app :)




I don't see how they are better or worse than Apple either but that's a discussion for another thread :)

P.S. What is a Data Commissioner?
 
Hi, thanks for the replies, (I had an N900, and it was rare to get any replies on those forums).

Well, I am beginning to love my phone after a day with it, the connectivity is amazing.

The app that was asking to be updated is 'Samsung Apps', and you may say that it's from Samsung it should be safe, but take a look at google's policies!

Also, after We City trawled my contacts, I don't trust Samsung at all.

Re: Apple, I would say that you can control your privacy a little better with Apple, but I should have known that really, as Google are involved here, but you're right, there's a whole discussion there.

Data Commisioner sorry that should have been the Information Commisioner, it's who looks after Data Protection in the UK, I'm pretty sure that what We City did to my contacts is actually illegal in the UK (I'm v unhappy about it as some were actually business contacts).

There is an increasing threat of identity fraud to all of us, I can look after my details, but it's out of my hands when my contacts themselves use apps like We City. I recently developed a facebook app, it was scary what personal info fb developers have access to, they can even read your fb messages! Yesterdays experience has shown me that it is a growing trend, and I really don't like it, remember the emails that used to circulate asking for your mother's maiden name or the name of your first pet, these were disguised as a bit of fun, but most were wise to them, well google and others are getting far more info about you.
 
Ginola said:
...
Click to expand...


That sucks that the app embarrassed you by sending spam to your contacts. I think you're blaming the wrong people though. You're upset at Samsung and Google, but We City sounds like the people who actually caused you harm. I would focus on them. I would also be careful what you install on any electronic/software device just as you should be careful what email you open, and what websites you visit, and what streets you walk down :)

But as for We City I'd suggest you report the app as malicious if you feel that it is. Android is a community, and it can only ever be as good as its supporters/users/devs. We need people to participate and say what they think and report malicious apps.
 
alostpacket said:
But as for We City I'd suggest you report the app as malicious if you feel that it is. Android is a community, and it can only ever be as good as its supporters/users/devs. We need people to participate and say what they think and report malicious apps.
Click to expand...

I shall try to report We City, I have a feeling; 1) it wont be easy, 2) no one will be interested, I could be wrong, but I think we probably have to deal with privacy issues as individuals ultimately.

I also found today that data, including wifi passwords, gets synced with google by default from the s2, settings > privacy.

I do not want to share anything I don't have to with google as sharing means giving them equal ownership, and they will have this info forever! (it maybe safe now, but it might not always be)
 
'Meanwhile, dozens of apps were found to have the same type of access to sensitive information as known spyware does, including access to the content of emails and text messages, phone call information, and device location, said Dan Hoffman, chief technology officer at SMobile Systems.'

Report: Be aware of Android Apps - ZDNet
 
Ginola said:
I shall try to report We City, I have a feeling; 1) it wont be easy, 2) no one will be interested, I could be wrong, but I think we probably have to deal with privacy issues as individuals ultimately.

I also found today that data, including wifi passwords, gets synced with google by default from the s2, settings > privacy.

I do not want to share anything I don't have to with google as sharing means giving them equal ownership, and they will have this info forever! (it maybe safe now, but it might not always be)
Click to expand...

That's fine but you have discovered how to turn off that syncing. Many people are fine with sharing WiFi configurations. You can always change your WiFi password now if you feel it really is needed.

The reality is that Google is an ad company and as a result they will track some things. So does Apple, MS, RIM and all the other.

However it's generally no more than your standard website would track. And, it's certainly no more than the credit bureaus have tracked for years before the internet. Privacy is important but people should be aware of why it matters, what harm can come to them and why companies are interested in their data.


Ginola said:
'Meanwhile, dozens of apps were found to have the same type of access to sensitive information as known spyware does, including access to the content of emails and text messages, phone call information, and device location, said Dan Hoffman, chief technology officer at SMobile Systems.'
Click to expand...

This is just scaremongering by an antivirus company.


Finally, I'm beginning to become a bit concerned at the company bashing going on in this thread. Let's try and keep things constructive with tips on how to protect privacy or tips on how to be careful with your data.

The intention of this thread is to educate and inform users to give them better knowledge about their phones. There are plenty of anti-virus companies and trolls and shills who would happily scare users. There are also plenty of websites to report sensationalist news about malware.

But we dont do that here. We're aiming to be a bit different and provide a positive, pro-active and educational angle on the subject.

There are enough people saying "X is bad"

But not enough saying "one thing to try is Y, to prevent X"
 
Ok, I get exactly what you are saying (and nearly returned my phone the first time an app asked for my phone info) on the privileges which Market apps demand when you install them. I only hope that Ultra keyboard, which replaced HTC's putrid excuse for a virtual keyboard on my Droid Incredible isn't sending the app developer or his paid customers everything which I type. This would likely qualify in the Trojan Horse scenario. But aside from that, do I really need to worry about viruses and myriad malware, consuming phone memory and slowing it down with a virus scanner (firewall too, maybe)?

I ask the above because I went through this discussion a couple of years ago when I first began using Linux, and Android is supposedly based on that. They told me that I was wasting my time fretting with such Windows-world worries. If I now have to worry that some flash virus may slip through my Dolphin browser, or that I cannot trust those sites which post the phone numbers which are scanned to my dialer, well that is a sad state of development.
 
Good info here. I read the 1st page, skimmed the rest, thought I'd add a couple good apps related to a "safe" phone.

Gemini App Manager - Android app on AppBrain will show you exactly what the permissions are on every app you have installed.

Zoner AntiVirus Free | AppBrain Android Market is a fast AV/"find phone" app that I just started using. Seems to work well.

I uninstalled Gemini because knowing the permissions made me sick. If you've never looked at your https://www.google.com/dashboard/ it's rather scary what Google stores away "somewhere".
 
You must log in or register to reply here.
Back
Top Bottom