Jobe Posted November 16, 2014 Share Posted November 16, 2014 Found this and thought it might help/interest some people.Android permissions explained, security, avoiding malwareIntroI'm just uploader, not an expert, this article contents are collected from many different sources This guide aims to provide the basic info most people want to know about the security of their phones, and when to download, and when not to download applications from the Android Market.It's my hope that this will help people make more informed decisions and be safe about their application usage, privacy, and data. It is my firm belief that Android is a fundamentally safe platform. With some common sense, diligence, and the right knowledge of the potential threats, users can rest assured and enjoy their devices more thoroughly.While most of these tips will apply to any of the new app stores and markets now available for Android, this guide is written specifically for Google's original Android Market.Also, while this guide attempts to be as comprehensive as possible, there may be errors or misjudgments, or just opinions that are subjective. Please read it with the idea in mind that it's just a part of the information you may want to consider when downloading your apps.Deciding what to download is ultimately up to you, and that's the most important thing you'll need to remember. Background about AndroidThe first thing when understanding the security of your phone is to know a little bit about what makes it tick. Android is a 'lite' version of Linux with most applications that you download from the market written in Java.This is important to know because it means Android is very unlikely to ever get a 'virus' in the traditional sense. Part of the reason is because Linux is a fairly secure operating system that protects various parts of itself from other parts. This is similar to how Windows has admin accounts and limited user accounts. Because of this protection, applications downloaded from the market do not have access to anything by default. You must grant them permission for each activity they want to perform when they are installed. This is a very important point which we will address a bit later. Also due to some bad choices by Google, there are a few exceptions to this rule that we'll talk about in the permissions section.Nevertheless, while Android is very unlikely to get a 'virus', that does not mean you are completely safe from 'malware', 'spyware', or other harmful types of programs.Anti-virusThe efficacy of anti-virus apps on Android is a controversial subject on even the best of days. Needless to say, there are some very differing opinions on the necessity of having anti-virus software protecting your phone. Both sides of this debate have some credible and respectable reasons for their choice, so I will try and present both sides as objectively as I can. In full disclosure though, I personally do not use anti-virus on my phone. That's a personal choice I made. Plenty of security experts whom I respect do chose to use anti-virus on their phones. So ultimately this will be a choice that is yours alone to make and not something where you should take cues from other people. That said, here are the pros and cons of each side as best as I know them.One thing to remember though, is that each side may have some irrational or sensational arguments. These stem from either a sense of emotional justification or a vested interest in selling software. Put simply, neither side of the debate is above bad arguments and unintentional or intentional faulty logic.Benefits- Will protect you from all past threats- May protect you from a future threat- Often can have additional features for privacy and data protection- May have features to protect your phone if it is lost or stolenDrawbacks- May waste system resources like battery and memory- It's hard to protect from future/unknown threats- Can potentially cause serious harm to the OS (very rare but not unheard of)- May provide a false sense of security and encourage risky behaviorTypes of Dangerous ProgramsThe most common threats from Android applications are:1) When the app tricks the user into giving it permissions it does not need to do its job.2) When the app hides malicious code behind legitimate permissions.3) When the app tricks the user into entering in personal information or sensitive data (such as a credit card number).There are various ways malicious developers (also known as hackers or crackers) accomplish this. We'll briefly define each kind just to have a common understanding of the terms.Malware Malware generally is an all-encompassing term used to describe any harmful program. This includes spyware, viruses, and phishing scams. Sometimes the older term 'virus' is used in this context, but malware is now considered more accurate.Spyware Spyware is used to describe software or applications that read your information and data without you actually knowing it and reporting it back to some unknown third party for nefarious purposes. Oftentimes this includes keystroke loggers to steal passwords or credit card information. Some people include certain types of Advertising tracking in this category (sometimes called Adware, see below). However that's a much larger debate we wont cover here.PhishingPhishing and spyware are closely related. They work on a similar principle: tricking the user and sending user information to a 3rd party to steal it. The difference with phishing however, is that the application (or website) will pretend to be from a trusted source to try and 'trick' you into entering in your details. Contrastingly, spyware would try to hide itself from being known to the user. One way to think about the difference is that phishing is masquerading while spyware is hiding, but the end goal of stealing your data is the same.An example of this would be an app or website pretending to be affiliated with your bank or Paypal or your email provider (Gmail, Hotmail, Yahoo). However it can, and does, include any service where someone might want to steal your identity or password.There have been known successful phishing attacks related to at least one bank on Android.VirusThe definition of virus used to be more all-encompassing. These days that term has been replaced by malware. Virus is more typically used to describe a specific type of software that takes control of your operating system and either damages it, or uses it for its own purposes. An example might be when a virus sends emails to everyone in your email address book. Again this is the type of program least likely to be a problem for Android.Trojan HorseA trojan horse is really just a specific type of virus. It merely refers to the idea that the app pretends to be something useful or helpful or fun for the user while actually causing harm or stealing data. This term is often used to describe spyware and phishing attacks as well.AdwareAdware is typically a bit of a grey area. Sometimes this is also called nuisance-ware. This type of application will often show the users an excessive amount of advertising in return for providing a service of dubious quality to the user. However, this type of program can often be confused with legitimate ad-supported software, which shows a mild to moderate amount of advertising while providing a useful service that the user wants. Because it can be hard to tell the difference, there exists a grey area from most anti-virus companies as to how to handle adware.How to check PermissionsWhen you install an application the Market will tell you all of the permissions it needs to function. These are important to read. Permissions can give you an idea if an application is asking for more than it needs to function properly. While some legitimate apps often ask for more permissions than they need, it should at least raise an eyebrow. Again this is just part of what you should consider when deciding if an application is safe and good quality.Note: in the latest version of the phone version of the Android Market the permissions are only shown after you click install. You will then be shown a screen with the list of permissions and an "Accept and Download" button.To see the permission given to an application after installation follow these steps:1) Go to you phone's settings2) Then select "Applications" or "Manage Applications"3) From there you should be able to get to an Application's specific settings. You should see buttons like "clear data." To see the permission you may need to scroll down a bitHow to Protect YourselfThere are no full-proof ways to avoid all bad situations in the world.But, any sane person with a reasonable head on their shoulders knowsthat a few good habits can keep you safe for a long, long time inwhatever you do. Here are a few tips I have learned from many years as aprofessional software developer and from reading many Android forumsthat have many people smarter and more knowledgeable than I aboutAndroid.Read the comments in the MarketThis should go without saying. Before you download any applications, besure to read the comments. Don't just read the first three either, clickthrough and see what people are saying. This can also help youunderstand how well an app works on your particular phone (and yourparticular version of Android). Comments should also be read EVERY timeyou update an app.It's also important to note that bad apps can sometimes"game" the comments and ratings. There are some unsavoryservices that provide thousands of fake comments for apps and they areprobably more common than you think. See the section on TheCommunity for more on identifying these types of fake comments.Check the RatingAny app that fails to maintain above 2.5 stars is likely not worth yourtime. If you are brave enough to be one of the first few to download anapp, this does not apply to you. Nevertheless, almost all good apps havebetween 3 and 5 stars. To me, this is just a general rule to helpfind quality apps.Check the permissionsThere are many things an app can do to, and for, your phone. Butanything an app can do is told to you when you download and install it.Before you download and install an app, you will be shown a list ofpermissions the application is requesting. Read them. Try yourbest to understand them in terms of what the application is supposed todo for you. For example, if you download a game of checkers, and theMarket warns you that it wants to be able to read your contacts, youshould think twice and probably not download it. There is no sanereason a game of checkers needs to know your friend's phone numbers.In the Permissions section you can read a list of some of the mostcommonly used permissions. The list explains how important they are,what they do, and notes some examples of apps that might legitimatelyneed the permission. This should help you get a basic understanding ofwhat to allow, and when to skip, an app.Check the developer's websiteMake sure the developer has a website and not just some blog. This isoften a good indication of quality as well as safety. If the developercares about their app they will likely have a relatively nice lookingwebsite (or, if they are open source, a site on Google Code or somethingsimilar). Note: sites on Google code are NOT verified or approved byGoogle. However, open source is usually (but not always) morelikely to indicate a safe application.NOTE: This is not a definitive indicator if a developer is good or bad,just one more piece of information you can use. There are a lot ofexceptions to this particular rule, as a lot of good developers mightnot have anything more than a blog, and a lot of bad developers couldjust point to a nice looking site they have no affiliation with.However, the developer's website can be helpful just as an extra pieceof information you can use in making your decision about the developeror app.Updating applications is the same as installing them freshEach time you update an application on your phone, you should use thesame diligence as if you were installing it for the first time. Rereadthe permissions to see that it is only asking for what it needs and nomore. Reread the comments to see if anything has changed in the opinionsof the users and to see if it still works for your phone. If you seethat an application says Update (manual) next to it, that means thedeveloper has changed the permissions that they are requesting. This isnot necessarily a bad thing -- but it should indicate that you shouldpay a bit closer attention to the permissions and re-evaluate them asneeded.PrivacyWi-FiOne of the things to remember when trying to keep yourself safe is to be very careful with public Wi-Fi. Whenever you connect to the internet through a public Wi-Fi, you should never use any website that requires a password to sign into. The danger here is because you have no idea who is connecting you to the website. A good analogy would be like trying to mail a letter to your friend by giving it to a stranger in the street. For more info read: Man-in-the-middle attack(Wikipedia). There is also a risk that applications may be transmitting data in the background over that Wi-Fi connection about you without encrypting it. This is also true of any applications over any internet connection however. And while there are some good ways to secure your phone, I personally don't use any public Wi-Fi at all. This may be seen as extreme in some circles, but I believe it to be safest route (although somewhat limiting).SD CardsThere isn't much to say about SD cards except that all users should remember that they are not a safe place to store personal information. This can be something as simple as a backup/export of your contacts.The reason the SD card is not safe is that nearly all applications can read any file they want from the SD card. Most personal info such as contacts is stored internally in protected databases however, so this shouldn't be a huge concern for most people, but it's helpful to keep in mind.GPS and Network LocationThere is a lot of information online and in various books about why letting yourself be tracked has potential consequences. However, there are a lot of useful features that apps can provide with location tracking information. You should treat location tracking with care and be sure to give it only to parties your trust. Google Maps would be a great example of this.Advertising and location trackingThere is a trade-off that some people will consider making with regards to location tracking. Some advertisers would like to have location information on you in order to show you local advertisements and coupons. In exchange, you get free use of an app such as a game. This is a decision you will need to make for yourself. I personally would not make this trade off, but some people very knowledgeable about security are very comfortable making it.permissionsWhen you install an application the Market will tell you all of the permissions it needs to function. These are important to read as it can give you an idea if the application is asking for permission to do more than it needs. While some legitimate apps often ask for more permission than they need, it should at least raise an eyebrow when deciding if an application is safe and of good quality.Make phone callsServices that cost you moneyURI: android.permission.CALL_PHONERisk: HIGHProtection level: DANGEROUS Official DescriptionAllows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.DetailsThis permission is of high importance. This could let an application call a 1-900 number and charge you money. However, this is not as common a way to cheat people in today's world as it used to be. Legitimate applications that use this include: Google Voice and Google Maps.Another important point to note here is that any app can launch the phone screen and pre-fill a number for you. However, in order to make the call, you would need to press [send] or [Call] yourself. The difference with this permission is that an app could make the entire process automatic and hidden.Send SMS or MMSServices that cost you money[color=ery commonly used by legitimate applications. Applications that typically need this permission include (but are not limited to) camera applications, audio/video applications, document applicationsWARNING:Any app targeting Android 1.5 or below (possibly 1.6 as well) will be granted this permission BY DEFAULT and you may not ever be warned about it. It is important to pay attention to what version of Android an app is targeting to know if this permission is being granted. You can see this on the Market website in the right hand column.Read ContactsDevelopment tools / Your personal infoURI: android.permission.READ_CONTACTSRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to read the user's contacts data.DetailsThis permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.Write contact dataDevelopment tools / Your personal infoURI: android.permission.WRITE_CONTACTSRisk: MODERATE-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to write (but not read) the user's contacts data.DetailsThis permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.Read calendar dataDevelopment tools / Your personal infoURI: android.permission.READ_CALENDARRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows an application to read the user's calendar data.DetailsThis permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information.Write calendar dataDevelopment tools / Your personal infoURI: android.permission.WRITE_CALENDARRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows an application to write (but not read) the user's calendar data.DetailsThis permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information.Read browser history & bookmarksDevelopment tools / Your personal infoURI: com.android.browser.permission.READ_HISTORY_BOOKMA RKSRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to read (but not write) the user's browsing history and bookmarks.DetailsThis permission is of medium-high importance. Browsing habits are often tracked through regular computers, but with this permission you'd be giving access to more than just browsing habits. There are also legitimate uses for this permission such as apps that sync or backup your data, and possibly certain social apps.Write browser history & bookmarksDevelopment tools / Your personal infoURI: com.android.browser.permission.WRITE_HISTORY_BOOKM ARKSRisk: MODERATE-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to write (but not read) the user's browsing history and bookmarks.DetailsThis permission is of medium-high importance. Browsing habits are often tracked through regular computers, but with this permission you'd be giving access to more than just browsing habits. There are also legitimate uses for this permission such as apps that sync or backup your data, and possibly certain social apps.Read sensitive logsDevelopment tools / Your personal infoURI: android.permission.READ_LOGSRisk: VERY-HIGHProtection level: DEVELOPMENT Official DescriptionAllows an application to read the low-level system log files.DetailsThis permission is of high importance. This allows the application to read what any other applications have logged.Modify global system settingsHardware controlsURI: android.permission.WRITE_SETTINGSRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows an application to read or write the system settingsDetailsThis permission is pretty important but only has the possibility of moderate impact. Global settings are pretty much anything you would find under Android's main 'settings' window. However, a lot of these settings may be perfectly reasonable for an application to change. Typical applications that use this include: volume control widgets, notification widgets, settings widgets, Wi-Fi utilities, or GPS utilities. Most apps needing this permission will fall under the "widget" or "utility" categories/types.Read sync settingsHardware controlsURI: android.permission.READ_SYNC_SETTINGSRisk: LOW-MODERATEProtection level: UNKNOWN Official DescriptionAllows applications to read the sync settingsDetailsThis permission is of low to medium importance. It mostly allows the application to know if you have background data sync (such as for Facebook or Gmail) turned on or off.Automatically start at bootHardware controlsURI: android.permission.RECEIVE_BOOT_COMPLETEDRisk: MODERATE-HIGHProtection level: UNKNOWN Official DescriptionAllows an application to receive the ACTION_BOOT_COMPLETED that is broadcast after the system finishes booting.DetailsThis permission is of low to moderate impact. It will allow an application to tell Android to run the application every time you start your phone. While not a danger in and of itself, it can point to an applications intentRestart other applications Hardware controlsURI: android.permission.RESTART_PACKAGESRisk: HIGHProtection level: UNKNOWN Official DescriptionThis constant is deprecated. The restartPackage(String) API is no longer supported.DetailsThis permission is of low to moderate impact. It will allow an application to tell Android to 'kill' the process of another application. However, any app that is killed will likely get restarted by the Android OS itself.Retrieve running applicationsHardware controlsURI: android.permission.GET_TASKSRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to get information about the currently or recently running tasks: a thumbnail representation of the tasks, what activities are running in it, etc.DetailsThis permission is of moderate importance. It will allow an application to find out what other applications are running on your phone. While not a danger in and of itself, it would be a useful tool for someone trying to steal your data. Typical legitimate applications that require this permission include: task killers and battery history widgets. Other than that however, most apps should not need this permission.Display system-level alertsHardware controlsURI: android.permission.SYSTEM_ALERT_WINDOWRisk: HIGHProtection level: DANGEROUS Official DescriptionAllows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.DetailsThis permission is of high importance. This permission allows an app to show a "popup" window above all other apps, even if the app is not in the foreground. A malicious developer/advertiser could use it to show very obnoxious advertising. Almost no apps should require this permission unless they are part of the Android operating system. An example of a system alert would be the alert you are shown when your phone or tablet is out of battery and is about to shut down.Control vibratorDevelopment toolsURI: android.permission.VIBRATERisk: LOWProtection level: UNKNOWN Official DescriptionAllows access to the vibratorDetailsThis permission is of low importance. As it states, it lets an app control the vibrate function on your phone. This includes for incoming calls and other events.Take pictures and videosDevelopment toolsURI: android.permission.CAMERARisk: MODERATE-HIGHProtection level: DANGEROUS Official DescriptionRequired to be able to access the camera device.DetailsThis permission is of moderate importance. As it states, it lets an app control the camera function on your phone. In theory this could be used maliciously to snap unsuspecting photos, but it would be unlikely and difficult to get a worthwhile picture or video. However, it is not impossible to make malicious use of cameras.Access location extra commandsNetwork CommunicationURI: android.permission.ACCESS_LOCATION_EXTRA_COMMANDSRisk: MEDIUM-HIGHProtection level: UNKNOWN Official DescriptionAllows an application to access extra location provider commandsDetailsThe specifics of the extra commands here are a bit unclear. However, the usage of this permission indicates that an app wants to know detailed information about your location, and respond accordingly. This is often used with advertising and location-based and social-network services like Four Square, Twitter, Facebook or Google Places/Google+. It is recommended that you treat this permission with the same caution as the GPS location permission and assume the same implications to privacy apply.Access mock locationNetwork CommunicationURI: android.permission.ACCESS_MOCK_LOCATIONRisk: MODERATEProtection level: DANGEROUS Official DescriptionAllows an application to create mock location providers for testingDetailsThis is a permission used for development of apps that make use of location based services. By creating "mock" (fake) locations, apps can test if their code works correctly depending on your location.This permission has no known sercurity considerations; Nor much use in a app released to the public.Battery statsHardware controlsURI: android.permission.BATTERY_STATSRisk: LOWProtection level: UNKNOWN Official DescriptionAllows an application to collect battery statisticsDetailsThis permission is of little to no importance.Bluetooth AdminYour accountsURI: android.permission.BLUETOOTH_ADMINRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows applications to discover and pair bluetooth devicesDetailsBluetooth (Wikipedia: http://en.wikipedia.org/wiki/Bluetooth) is a technology that lets your phone communicate wirelessly over short distances. It is similar to Wi-Fi in many ways. It itself is not a danger to your phone, but it does enable a way for an application to send and receive data from other devices. Typical applications that would need bluetooth access include: sharing applications, file transfer apps, apps that connect to headset or wireless speakers.Broadcast Sticky (Intents) Hardware controlsURI: android.permission.BROADCAST_STICKYRisk: LOW-MEDIUMProtection level: UNKNOWN Official DescriptionAllows an application to broadcast sticky intents. These are broadcasts whose data is held by the system after being finished, so that clients can quickly retrieve that data without having to wait for the next broadcast.DetailsThe permission has to do with how applications "talk" to each other using a communication method called "Intents". While this permission is highly technical it is a relatively low importance. There are no know obvious malicious uses for this permission.Change ConfigurationHardware controlsURI: android.permission.CHANGE_CONFIGURATIONRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to modify the current configuration, such as locale.DetailsThis is a permission that generally should not be granted to regular apps. Other than changing the locale (i.e. language), it is unclear what configuration changes this permission allows. As such, it should be treated with considerable caution.Clear app cacheHardware controlsURI: android.permission.CLEAR_APP_CACHERisk: LOWProtection level: DANGEROUS Official DescriptionAllows an application to clear the caches of all installed applications on the device.DetailsThis permission is of low importance. It allows an app to clear the cache of apps on the phone or tablet. The cache is a place that an app stores recently used data for faster access. Clearing the cache can sometimes (very rarely) fix bugs related to those files. Clearing these files generally presents no risk other than to slow the performance of the phone or tablet (as apps will need to re-create the caches when used).Disable Keyguard (lock screen)(unknown category)URI: android.permission.DISABLE_KEYGUARDRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows applications to disable the keyguardDetailsThis permission is of medium-high importance. It allows an app to disable the "lock screen" that most phones go into after going to sleep and been turned on again. This lockscreen can sometimes be a password screen, or a PIN screen, or just a "slide to unlock" screen.Expand status barHardware controlsURI: android.permission.EXPAND_STATUS_BARRisk: MEDIUM-HIGHProtection level: UNKNOWN Official DescriptionAllows an application to expand or collapse the status bar.DetailsThis appears to be a system permission -- not for use by regular applications. If you come across this permission I would beware of any app requesting it that is not an Android system app.FlashlightDevelopment toolsURI: android.permission.FLASHLIGHTRisk: LOWProtection level: UNKNOWN Official DescriptionAllows access to the flashlightDetailsThis allows apps to turn on or off the LED "flash" light used by the camera. This is a handy tool but usually of no risk itself.Get package sizeHardware controlsURI: android.permission.GET_PACKAGE_SIZERisk: LOW-MODERATEProtection level: UNKNOWN Official DescriptionAllows an application to find out the space used by any package.DetailsThis permission does not seem to have any risk associated with it.Kill background processesHardware controlsURI: android.permission.KILL_BACKGROUND_PROCESSESRisk: HIGHProtection level: UNKNOWN Official DescriptionAllows an application to call killBackgroundProcesses(String).DetailsThis permission is a bit of a tricky one. Often this is used by what are called "task killers". These apps supposedly free system resources by closing apps running in the background. However the usefulness of such apps is minimal at best. They can help close an app that is misbehaving, however a user can already do that themselves through the Android settings under "Apps" or "Manage Applications". Conversely this permission has some potential to maliciously close anti-virus or other security related apps. As with anything I would treat this with caution. Few users should ever need an app with this permission. Rather, it could be an indicator of malicious intent (especially if not requested by a task killer or system performance tuning app).Modify audio settingsHardware controlsURI: android.permission.MODIFY_AUDIO_SETTINGSRisk: LOWProtection level: DANGEROUS Official DescriptionAllows an application to modify global audio settingsDetailsThis permission is of low importance. Audio settings pose little to no risk to the device.Format file systemsYour personal informationURI: android.permission.MOUNT_FORMAT_FILESYSTEMSRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows formatting file systems for removable storage.DetailsThe primary danger with this permission is that it could be used to erase data from an SD card or other similar storage in your phone. This is also not a permission any normal app should need.Mount / Unmount file systemsYour personal informationURI: android.permission.MOUNT_UNMOUNT_FILESYSTEMSRisk: MODERATEProtection level: DANGEROUS Official DescriptionAllows mounting and unmounting file systems for removable storage.DetailsThis permission just allows for connecting to SD cards for reading and writing. While not a risk itself, this is also not a permission any normal app should need.NFC (Near Field Communication)Your accountsURI: android.permission.NFCRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows applications to perform I/O operations over NFCDetailsNFC stands for Near Field Communication. This is a technology like Bluetooth that enables short range communication between two devices or the reading of NFC "tags". The distance which NFC is able to work is only a few centimeters so that devices (or a device and a tag) must effectively be touching each other to communicate. Due to the distance, this technology is not particularly dangerous. However it does present a small risk and it is something that should used with caution.For more info: http://en.wikipedia.org/wiki/Near_field_communicationProcess outgoing callsYour locationURI: android.permission.PROCESS_OUTGOING_CALLSRisk: VERY-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to monitor, modify, or abort outgoing calls.DetailsThis permission is of high importance. This would allow an app to see what numbers are called and other personal info. Generally this permission should only be seen on apps for VOIP (Voice Over Internet Protocol) like Google Voice or dialer replacement type apps.Read sync statsHardware controlsURI: android.permission.READ_SYNC_STATSRisk: MODERATEProtection level: UNKNOWN Official DescriptionAllows applications to read the sync statsDetailsThis permission is related to "Read sync settings" but not particularly dangerous itself. There is a minor risk that some personal information could be gleaned from the sync stats, but the information is unlikely to be valuble. Sync in this case relates to syncing of contacts and other types of media on the phone.Record audioDevelopment toolsURI: android.permission.RECORD_AUDIORisk: MODERATE-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to record audioDetailsWhile this permission is not typically dangerous, it is a potential tool for eavesdropping. However recording audio has legitimate uses such as note taking apps or voice search apps. As a side note recording audio is typically a significant drain on the battery.Set alarmHardware controlsURI: android.permission.SET_ALARMRisk: LOWProtection level: UNKNOWN Official DescriptionAllows an application to broadcast an Intent to set an alarm for the user.DetailsThis permission seems to be of low risk because it doesnt allow the setting of the alarm directly. Rather it allows the opening of the alarm app on the phone.Set time zoneHardware controlsURI: android.permission.SET_TIME_ZONERisk: LOWProtection level: DANGEROUS Official DescriptionAllows applications to set the system time zoneDetailsThis permission poses little, if any, riskSet wallpaperHardware controlsURI: android.permission.SET_WALLPAPERRisk: LOWProtection level: UNKNOWN Official DescriptionAllows applications to set the wallpaperDetailsThis permission poses little, if any, riskSubscribed feeds readDevelopment tools / Your personal infoURI: android.permission.SUBSCRIBED_FEEDS_READRisk: MEDIUMProtection level: UNKNOWN Official DescriptionAllows an application to allow access the subscribed feeds ContentProvider.DetailsThis would give an app access to RSS feed that you have subscribed to. If you dont subscribe to any RSS feeds this permission is of little risk. If you do, this permission is akin to letting an app have access to your broser history. It could glean interests and preferences and other semi-personal information.Subscribed feeds writeDevelopment tools / Your personal infoURI: android.permission.SUBSCRIBED_FEEDS_WRITERisk: LOW-MEDIUMProtection level: DANGEROUS Official Description(No developer documentation is available for this permission)DetailsThis would give an app access to RSS feed that you have subscribed to. If you dont subscribe to any RSS feeds, this permission is of little risk. If you do, this permission is akin to letting an app have access to your broser history. It could glean interests and preferences and other semi-personal information.Use SIPYour accountsURI: android.permission.USE_SIPRisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to use SIP serviceDetailsSIP stands for Session Initiation Protocol. It is a technology mostly used for making video and voice calls over the Internet. While not a major security risk it should be treated with almost as much caution as the standard "make phone calls" permission.Write secure settingsHardware controlsURI: android.permission.WRITE_SECURE_SETTINGSRisk: VERY-HIGHProtection level: DEVELOPMENT Official DescriptionAllows an application to read or write the secure system settings.DetailsThis permission should only be seen on Android system apps (and possibly wireless carriers or hardware manufacturer pre-installed apps).Write SMSServices that cost you moneyURI: android.permission.WRITE_SMSRisk: HIGHProtection level: DANGEROUS Official DescriptionAllows an application to write SMS messages.DetailsThis permission appears to be an offshoot from the "send SMS" permission. This should allow an app to write, but not send an SMS message. Users should still be cautious of this permission however. Many kinds of malware lure users into sending SMS to special for-pay numbers costing them money.Write sync settingsYour messagesURI: android.permission.WRITE_SYNC_SETTINGSRisk: MEDIUMProtection level: DANGEROUS Official DescriptionAllows applications to write the sync settingsDetailsThis permission relates to backup and sync of certain types of information like contacts. This allows an app to write settings for how that account and the data are sync and backed up. This is a common permission for social services or contact managers or any other type of app with an account associated with it. Alone, this permission doesn't allow an app access to contacts or other sensitive data. Rather, it just relates to how that data is backed up. Nevertheless, care should be taken as always.Read profileDevelopment tools / Your personal infoURI: android.permission.READ_PROFILERisk: MEDIUM-HIGHProtection level: DANGEROUS Official DescriptionAllows an application to read the user's personal profile data.DetailsThis a new permission that relates to a special new "Me" contact you can create in your phone or tablet as your own profile.Install Shortcut (Android Launcher)Hardware controlsURI: com.android.launcher.permission.INSTALL_SHORTCUTRisk: MODERATE-HIGHProtection level: UNKNOWN DetailsThis is a custom permission for the default Android Laucher (the home screen). This permission would allow an app to put an icon or shortcut there. While not dangerous, this can sometimes be a sign of a potentially malicious or adware app. For more on adware, see the guides section of PocketPermissions.Read external storageYour personal informationURI: android.permission.READ_EXTERNAL_STORAGERisk: LOWProtection level: UNKNOWN Official DescriptionAllows an application to read from external storage.DetailsThis permission is granted to all apps by default.Read SMSSystem toolsURI: android.permission.READ_SMSRisk: MODERATE-HIGHProtection level: DANGEROUS DetailsThis permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS replacment" apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.Write call logYour locationURI: android.permission.WRITE_CALL_LOGRisk: MEDIUM-HIGHProtection level: DANGEROUS DetailsThis permission is not much of a danger by itself, but rather could be used to hide other malicious behavoir. However it has a legitimate purpose for dialer replacements or voice over IP apps (like Google Voice).Write profileDevelopment tools / Your personal infoURI: android.permission.WRITE_PROFILERisk: MODERATE-HIGHProtection level: DANGEROUS DetailsThis a new permission that relates to a special new "Me" contact you can create in your phone or tablet as your own profile.Read social streamDevelopment tools / Your personal infoURI: android.permission.READ_SOCIAL_STREAMRisk: HIGHProtection level: DANGEROUS DetailsThis permission is very important. It is a new permission introduced with Android 4.0 (Ice Cream Sandwhich). This permission would allow an app to read updates from social networking apps like Google+, Twitter, and Facebook. By granting this permission you are giving an app the ability to read not only your information, but any updates posted by people in your social circles.Add voicemailSystem toolsURI: com.android.voicemail.permission.ADD_VOICEMAILRisk: MEDIUM-HIGHProtection level: DANGEROUS DetailsThis seems to be a new permission related to Android's new centralized voicemail system. It would be an unusual means for an app to use this permission maliciously. However few apps should need it and, as always, it should be treated with caution.Authenticate AccountsYour messagesURI: android.permission.AUTHENTICATE_ACCOUNTSRisk: VERY-HIGHProtection level: DANGEROUS DetailsThis permission is of high importance. It allows an app to authenticate credentials (such as passwords). Typical uses of this would be if an app had it's own type of account on your phone such as Google, Facebook, or Twitter.This permission is closely related to the Account Manager permission. Both are typically requested together.While this doesn't directly give an app access to your personal information or passwords, it does present a security risk for phishing (tricking the user into revealing their password). For more on phishing, see the Guides section of PocketPermissions)Read email attachmentsDevelopment tools / Your personal infoURI: com.android.email.permission.READ_ATTACHMENTRisk: HIGHProtection level: DANGEROUS DetailsThis is a custom permission for the default Android email app (i.e. not Gmail). This permission should be treated with great caution. Many email attachments contain highly sensitive and personal or financial information.Read user dictionaryDevelopment tools / Your personal infoURI: android.permission.READ_USER_DICTIONARYRisk: LOWProtection level: DANGEROUS Official DescriptionAllows an application to read the user dictionary.DetailsThis would allow an app to read words added to your custom dictionary. Oftentimes this is abbreviations like "brb" that you might add for typing text messages. Unless you save personal information in your dictionary, this permission is of almost no risk.Write user dictionaryHardware controlsURI: android.permission.WRITE_USER_DICTIONARYRisk: LOWProtection level: UNKNOWN Official DescriptionAllows an application to write to the user dictionary.DetailsThis alows an app to add custom words to your user dictionary. For example, the common acronym "brb" for "be right back".Receive SMSSystem toolsURI: android.permission.RECEIVE_SMSRisk: HIGHProtection level: DANGEROUS Official DescriptionAllows an application to monitor incoming SMS messages, to record or perform processing on them.DetailsThis permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS replacment" apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.Receive MMSSystem toolsURI: android.permission.RECEIVE_MMSRisk: HIGHProtection level: DANGEROUS Official DescriptionAllows an application to monitor incoming MMS messages, to record or perform processing on them.DetailsThis permission is mostly a privacy concern. Any app that can read your MMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS/MMS replacment" apps (such as Handcent) and would naturally need this permission to function.Install DRMHardware controlsURI: android.permission.INSTALL_DRMRisk: MODERATE-HIGHProtection level: UNKNOWN DetailsDRM stands for Digital rights management. Typically this permission is not particularly dangerous itself. However, it is a permission related to controlling access to medi such as books, audio video, and more. Due to its purpose to control access, I would be especially careful installing any app requesting it.More info: http://en.wikipedia.org/wiki/Digital_rights_managementAdd system serviceHardware controlsURI: android.permission.ADD_SYSTEM_SERVICERisk: CRITICALProtection level: UNKNOWN DetailsThis permission should only be given to Android System apps (and possibly to wireless carrier or hardware manufacturer pre-installed apps)Access WiMax StateYour accountsURI: android.permission.ACCESS_WIMAX_STATERisk: LOW-MODERATEProtection level: UNKNOWN DetailsWiMax is a technology developed for "4G" data and internet speeds on mobile devices. This permission allows an app to see if it is currently connected to a wireless network that uses WiMax. There is no significant risk associated with this permission.Change WiMax stateYour accountsURI: android.permission.CHANGE_WIMAX_STATERisk: MODERATEProtection level: DANGEROUS DetailsThis permission allows an app to turn on or off the WiMax radio. WiMax is a type of "4G" wireless connection like LTE. This permission essensially allows an app to turn on or off 4G.Read instant messages (IM)Development tools / Your personal infoURI: com.android.providers.im.permission.READ_ONLYRisk: HIGHProtection level: UNKNOWN DetailsThis is apermission realated to reading instant messages, such as those on GooleTalk.RECEIVE(unknown group)URI: com.google.android.c2dm.permission.RECEIVERisk: LOWProtection level: UNKNOWN DetailsC2D stands for Cloud to Device Messaging. This is a push notification technology that is being phased out for a similar technology called GCM. (Google Cloud Messaging). This permission is of little to no risk.In-app billingServices that cost you moneyURI: com.android.vending.BILLINGRisk: CRITICALProtection level: UNKNOWN Link to comment Share on other sites More sharing options...
jackieo Posted November 16, 2014 Share Posted November 16, 2014 Wow! Right Click "save page as" to desktop ! awesome post! :)edit: rated 5 stars! Link to comment Share on other sites More sharing options...
smallhagrid Posted November 21, 2014 Share Posted November 21, 2014 PDF of the OP for anyone who wants it...http://www.mirrorcreator.com/files/174ADZB8/perm_sec.pdf_links Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.