• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Android permissions explained, security tips, and avoiding malware

yamafx4dude said:
Im getting tv commercials in my library gallery with thumbnail pics saying the ad's are from TAPJOY. I should have read this post earlier, im guessing I gave permission to an ap to write to my SD card.
Click to expand...


I would imagine it would be very hard to avoid that permission. Almost all apps request it. However, when ads like that show up in your gallery it is usually a mistake.

I'm curious do you have any idea what app it may have been?


These threads may help:

http://androidforums.com/android-ga...-images-your-gallery-w-o-your-permission.html

http://androidforums.com/android-me...-images-video-audio-out-gallery-music-db.html

http://androidforums.com/android-media/438325-video-downloads-appearing-gallery-app.html
 
Stumbled onto this article whilst researching the AirPush spam that some apps install.

A great read. I'd like to see Google provide the option to block certain permissions an app requests. I appreciate it might crash the app but if its a permission for a rairly used feature, like sending an email or reading contact info then it would be great.

I know there are apps for doing this on a rooted phone or with custom firmware, but thats a whole oither security worry.
 
Question to ask, has anything changed since the original post of this thread, which is very informative, about Google's stance on testing apps before it's placed on the market?

Reason why I ask is because I was at my local Verizon Wireless and heard one of the sales reps tell a customer that the Android Market can be very unsafe because anyone can create an Google Market app, publish it, and have it do malicious things before the customer or Google can notice it. Of course that same rep dug himself into a hole when another customer over heard all this and wanted to know why he was sold an android phone if the rep and his company knew all this about the Anrdroid Market. Thought it was a bit hilarious to see him try and get out it.

But still that whole thing did get me thinking. I was some what under the impression that Google did some basic level of app testing before allowing it go on the market. However reading the original post seems to imply that none is done other than making sure that the app has some kind of digital signature and more or less Google only reacts to malware that placed on the Android Market.

So has Google changed anything in regards to app development for Google Market or is it still business as usual?
 
That's a good question Uknown_User, thanks.

Google certainly hasn't changed their stance on pre-screening apps, but I'm pretty sure they have added a larger staff to those they follow up on reports of malware. And I believe they investigate every single report in a pretty timely manner all things considered.

They may do some filtering for some types of know threats, but that is not something they would disclose to the public, so there is no way to confirm for sure.

I actually think that they probably do actually have some automated filtering either currently in use or planned as a soon to be used feature.

The reason I think this is based upon an educated guess by looking at some of their other products. For example, they have something called "Webmaster Tools" which is a set of web tools to help you have your website indexed by Google's search engine properly. In these tools they report to the webmasters if they are running out of date software and other similar "auto threat detection" mechanisms.

Finally, not to put down Verizon reps (they are not all created equal) but you should take what a in-store rep says about anything with a HUGE grain of salt.

This is not to say they are stupid or have ulterior motives, but just that they are not necessarily knowledgeable on the subjects they are discussing. This is simply because it is not a function of their job. They work on commission, and their job is simply to sell phones. Having a vast amount of knowledge isn't required to sell a phone, so as a result, some reps will make claims on subjects they only have limited knowledge on.

I say this because I consider Android to be a fundamentally safe platform. I think it's safer than desktop computers, safer than the web in general and *nearly* as safe as a iPhone (with the differences being very small).

Pre-screening can help a little but it is less than people think. Quite a few malicious apps have made it into the iTunes App Store.

In my opinion, what really protects people is being conscious and educated as to their own security and privacy and being diligent in regards to what they install.


hth :)
 
Thanks for this informative thread. My first Android is arriving in a couple days and I'd like to keep it as secure as possible.

When installing apps and the permissions are shown, is there anyway to disallow certain permissions, but still install the program? I just installed Android Marketplace in the Devkit Emulator and it asked for more permissions than I would usually want to give.

On my PCs, I use security policy and firewall rules to block unwanted or unnecessary outgoing connections from programs that don't need them or don't ask permission. I've heard about Droidwall, but didn't find it mentioned here. Is there a better firewall app? I also use sites like VirusTotal to scan files (as well as local anti-virus). Is there any online site that does malware scans on .apk files?

How do you feel about sites like getjar? Is that a trustworthy source for apps?

How do security conscious Android owners use public wifi? With my laptop and old tablet, I only use public wifi for casual browsing without logging in (and browser privacy mode, so cookies and other things aren't stored beyond a temporary session).

I read about people emailing, posting on all sorts of sites, using Groove IP/Google Voice, Netflix, Android Market, Amazon Appstore and other services from public wifi. Doesn't this mean all your logins, account information and other traffic can be sniffed? Even https connections don't seem very secure these days. Also some sites seem to only use https for the login, then other traffic may be sent in the clear.

Does Android have an extra layer of security to make any of those activities secure on public wifi, or are lots of people using OpenVPN through a secure home system for all connections?

As for Android browsers like Dolphin and Opera, do they have equivalents of addons like Adblock, NoScript, FlashBlock and RequestPolicy? Do these browsers have Privacy modes?
 
Ayered said:
Thanks for this informative thread. My first Android is arriving in a couple days and I'd like to keep it as secure as possible.

When installing apps and the permissions are shown, is there anyway to disallow certain permissions, but still install the program? I just installed Android Marketplace in the Devkit Emulator and it asked for more permissions than I would usually want to give.

On my PCs, I use security policy and firewall rules to block unwanted or unnecessary outgoing connections from programs that don't need them or don't ask permission. I've heard about Droidwall, but didn't find it mentioned here. Is there a better firewall app? I also use sites like VirusTotal to scan files (as well as local anti-virus). Is there any online site that does malware scans on .apk files?

How do you feel about sites like getjar? Is that a trustworthy source for apps?

How do security conscious Android owners use public wifi? With my laptop and old tablet, I only use public wifi for casual browsing without logging in (and browser privacy mode, so cookies and other things aren't stored beyond a temporary session).

I read about people emailing, posting on all sorts of sites, using Groove IP/Google Voice, Netflix, Android Market, Amazon Appstore and other services from public wifi. Doesn't this mean all your logins, account information and other traffic can be sniffed? Even https connections don't seem very secure these days. Also some sites seem to only use https for the login, then other traffic may be sent in the clear.

Does Android have an extra layer of security to make any of those activities secure on public wifi, or are lots of people using OpenVPN through a secure home system for all connections?

As for Android browsers like Dolphin and Opera, do they have equivalents of addons like Adblock, NoScript, FlashBlock and RequestPolicy? Do these browsers have Privacy modes?
Click to expand...

Rooting your android device will give you some control over editing permissions. For unrooted devices I used an app called "App Shield".



(Click Here for an AF Discussion on App Shield with the market link)
 
Hi,
First big thanks for great job welldone. Just what i've been looking for and since i'm right now in a dilemma may i ask your advice?
I'm a novice in android (htc wildfire, acer iconia a100) and this i really will return to alot:-)
My question is about games, two in particular right now. The game catan and european war, since i can't find the game risk. The game catan wants access to retrieving running applications.....and the game european war wants permission to terminate backgroundprocesses....
Is this reasonable?
Again thanks for your work and an excellent guide:-)
Pernilla
 
Pernilla77 said:
Hi,
First big thanks for great job welldone. Just what i've been looking for and since i'm right now in a dilemma may i ask your advice?
I'm a novice in android (htc wildfire, acer iconia a100) and this i really will return to alot:-)
My question is about games, two in particular right now. The game catan and european war, since i can't find the game risk. The game catan wants access to retrieving running applications.....and the game european war wants permission to terminate backgroundprocesses....
Is this reasonable?
Again thanks for your work and an excellent guide:-)
Pernilla
Click to expand...


well hard to say, cause certain games will take up alot of ram and needs to kill background apps to make sure it runs smooth with no lag.:cool:
 
Yeah, nutmegg nailed it -- it's a permission that probably shouldn't be needed for a game, but it's not super unusual.

In reality I'd say the developer is just inexperienced, as killing background processes wont free memory for a game. The Dalvik VM allocates a fixed amount of RAM to any one app at a time.

The only instance where it might help would be if the guy was trying to create the graphics from assets on the fly. There used to be an old bug (fixed in Android 2.3 Gingerbread) where the system would run out of memory creating graphics. This is separate from "app memory" though -- and having an app kill processes wouldn't really prevent this bug I dont think.

Long story short: while it's not a permission I'd want an app to have, I wouldn't worry unless it was requesting other permissions that caused concern too.

In this particular situation, there is a semi-valid reason for that permission, so it's more of a "yellow flag" than a "red flag".
 
I'd say those two permissions always go together, so nothing unusual about seeing both of them.

Together they are a bit of a yellow flag, but my guess would be that it's not a big worry. It's possible they are up to something bad, but unlikely.
 
ALP,

I've noticed that a number of game apps have permission to change wifi info.

This is from Puffle Launch

SYSTEM TOOLS
CHANGE WI-FI STATE
Allows an application to connect to and disconnect from Wi-Fi access points, and to make changes to configured Wi-Fi networks.
PREVENT DEVICE FROM SLEEPING
Allows an application to prevent the device from going to sleep.
WRITE SYNC SETTINGS
Allows an application to modify the sync settings, such as whether sync is enabled for Contacts.
MODIFY GLOBAL SYSTEM SETTINGS
Allows an application to modify the system's settings data. Malicious applications can corrupt your system's configuration.
Click to expand...

Why in the bloody Christmas reef does an app need these permissions? I really like the app but I'm not sure if I want to keep them due to these permissions. I can't for the life of me stipulate why they need this.
 
Change Wi-Fi is mostly benign. It just allows for connecting to WiFi and turning it on or off. Almost any app that wants to run over WiFi will request it. Otherwise they have to prompt you and send you to the settings screen to turn WiFi on. Not very good User Experience (UX) design.

There is little it can do that's harmful. This is primarily because WiFi is limited by physical range. It would be pretty hard to write an app to connect people to a rouge WiFi network, just because you would never know when anyone would be in range of your signal.

hth :)
 
Ok, so one less permission I shouldn't worry about. I just read over the permission of Puffle launch and I don't like any of those permissions.

Would you keep the game based on the permissions requested?
 
Roze said:
Ok, so one less permission I shouldn't worry about. I just read over the permission of Puffle launch and I don't like any of those permissions.

Would you keep the game based on the permissions requested?
Click to expand...


I'm personally not big on apps that require a lot of Contact related permissions -- especially games, but it could have a legit use for multi-player/social games.

That and 'modify global settings' give me a bit of pause, but nothing in that list makes me say an absolute "no" .... maybe more of a "eh...." :D
 
Hello! Thanks for writing this guide. I found it quite useful and now I'm suspicious of some apps that I was planning to install. I'll just list them

1) Battery Status Widget - free (https://market.android.com/details?id=com.androidapps.widget.battery)
permissions: FULL INTERNET ACCESS and MODIFY/DELETE USB STORAGE CONTENTS MODIFY/DELETE SD CARD CONTENTS (why the heck would a widget like this need internet and sd card capabilities?)

2) Tiny Tower (https://market.android.com/details?id=com.mobage.ww.a560.tinytower_android)
permissions: FINE (GPS) LOCATION and READ PHONE STATE AND IDENTITY (its just a game so why would it need my location and know my phone state?)

3) AndroidIRC (https://market.android.com/details?id=com.androirc)
permissions: COARSE (NETWORK-BASED) LOCATION (why would it need to know my location?)

4) WidgetLocker Lockscreen (https://market.android.com/details?id=com.teslacoilsw.widgetlocker)
permissions: READ SENSITIVE LOG DATA and MODIFY/DELETE USB STORAGE CONTENTS MODIFY/DELETE SD CARD CONTENTS (why the heck would a *lockscreen* app need to read sensitive log data and mod sd contents?)

This one is most suspicious to me:

5) Shoot Bubble Deluxe (https://market.android.com/details?id=com.shootbubble.bubbledexlue)
permissions: READ PHONE STATE AND IDENTITY and MODIFY/DELETE USB STORAGE CONTENTS MODIFY/DELETE SD CARD CONTENTS (why the heck would a game like this need to know my phone state/identity and mod my sd card contents? it just doesnt make sense to me)
 
Actually, most (if not all) of those permissions make sense. The phone state and identity is like "Is the screen on?"--that sort of thing. It's not like what's your social security number and password. And a lot of apps and games store stuff (user preferences) on your SD card, so they do need to be able to modify and delete SD card contents.
 
aysiu said:
Actually, most (if not all) of those permissions make sense. The phone state and identity is like "Is the screen on?"--that sort of thing. It's not like what's your social security number and password. And a lot of apps and games store stuff (user preferences) on your SD card, so they do need to be able to modify and delete SD card contents.
Click to expand...


Yep this is pretty sound advice. :)

The READ_PHONE_STATE does include a bit more though. It allows the app to identify your device by the IMEI or IMSI number (not a big deal in itself but important to know). It also allows the app to read incoming & outgoing phone numbers if the app is running (either in the BG or foreground). I need to double check the last bit though.
 
ah. yeah I figured that the games would have to put the save data somewhere. But ok, try to explain why a battery widget needs the internet? lol

edit: and why widgetlocker wants to read sensative log data
 
Snake X said:
ah. yeah I figured that the games would have to put the save data somewhere. But ok, try to explain why a battery widget needs the internet? lol

edit: and why widgetlocker wants to read sensative log data
Click to expand...


Saving simple preferences does not need the SD card permission, however saving game state would be something that contains enough data to want to put it on the SD card.

As for the Battery + internet, you'd have to ask the dev. There isn't an obvious reason it MUST have the permission. Perhaps advertising related.


As for the widget, no app should ever have the read logs permission*. (my opinion)



(* with the exception of maybe a Google app in beta like Google+ or Google Music)


Also sorry, I didn't notice that permission when I first read your post
 
I know with Widget locker, there's a crash log that pops up and ask if you want to notify the dev of the crash. I have seen a number of apps with the read sensitive data log permission used for this reason. I have corresponded with the dev of widget locker via email and through XDA and I have some trust in him.
I haven't had widget locker crash on me since the app was still in beta.

Personally, I think that permission is useless as I have another app that I use to send crash log to the dev.
 
The problem is these apps could easily use their own log without asking special permission. That permission allows them to read the logs of OTHER apps.

And, while not the fault of the person requesting the permission, other apps tend to "leak" sensitive info like contact names, numbers and GPS coordinates, and so on. Even system apps and carrier apps make this "leak" mistake from time to time.


btw we miss the red roze :) glad to see ya still around though :)
 
You must log in or register to reply here.
Back
Top Bottom