[Android General] Diablo67:
Android Permissions & Security Explained Continued...

Continued From Page 7

Page 8 Of 10

Official Description

Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.

Details

This permission is of high importance. This could let an application call a 1-900 number and charge you money. However, this is not as common a way to cheat people in today's world as it used to be. Legitimate applications that use this include: Google Voice and Google Maps.

Another important point to note here is that any app can launch the phone screen and pre-fill a number for you. However, in order to make the call, you would need to press [Send] or [Call] yourself. The difference with this permission is that an app could make the entire process automatic and hidden.

Send SMS or MMS

Services that cost you money

[color=ery commonly used by legitimate applications. Applications that typically need this permission include (but are not limited to) camera applications, audio/video applications, document applications

[B]Official Description[/B]

Allows an application to read the user's contacts data.

Details

This permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.

Write contact data

Development tools / Your personal info

URI: android.permission.WRITE_CONTACTS

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to write (but not read) the user's contacts data.

Details

This permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.

Read calendar data

Development tools / Your personal info

URI: android.permission.READ_CALENDAR

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows an application to read the user's calendar data.

Details

This permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information.

Write calendar data

Development tools / Your personal info

URI: android.permission.WRITE_CALENDAR

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows an application to write (but not read) the user's calendar data.

Details

This permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information.

Read browser history & bookmarks

Development tools / Your personal info

URI: com.android.browser.permission.READ_HISTORY_BOOKMA RKS

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to read (but not write) the user's browsing history and bookmarks.

Details

This permission is of medium-high importance. Browsing habits are often tracked through regular computers, but with this permission you'd be giving access to more than just browsing habits. There are also legitimate uses for this permission such as apps that sync or backup your data, and possibly certain social apps.

Write browser history & bookmarks

Development tools / Your personal info

URI: com.android.browser.permission.WRITE_HISTORY_BOOKM ARKS

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to write (but not read) the user's browsing history and bookmarks.

Details

This permission is of medium-high importance. Browsing habits are often tracked through regular computers, but with this permission you'd be giving access to more than just browsing habits. There are also legitimate uses for this permission such as apps that sync or backup your data, and possibly certain social apps.

Read sensitive logs

Development tools / Your personal info

URI: android.permission.READ_LOGS

Risk: VERY-HIGH

Protection level: DEVELOPMENT

Official Description

Allows an application to read the low-level system log files.

Details

This permission is of high importance. This allows the application to read what any other applications have logged.

Modify global system settings

Hardware controls

URI: android.permission.WRITE_SETTINGS

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows an application to read or write the system settings

Details

This permission is pretty important but only has the possibility of moderate impact. Global settings are pretty much anything you would find under Android's main 'settings' window. However, a lot of these settings may be perfectly reasonable for an application to change. Typical applications that use this include: volume control widgets, notification widgets, settings widgets, Wi-Fi utilities, or GPS utilities. Most apps needing this permission will fall under the "widget" or "utility" categories/types.

Read sync settings

Hardware controls

URI: android.permission.READ_SYNC_SETTINGS

Risk: LOW-MODERATE

Protection level: UNKNOWN

Official Description

Allows applications to read the sync settings

Details

This permission is of low to medium importance. It mostly allows the application to know if you have background data sync (such as for Facebook or Gmail) turned on or off.

Automatically start at boot

Hardware controls

URI: android.permission.RECEIVE_BOOT_COMPLETED

Risk: MODERATE-HIGH

Protection level: UNKNOWN

Official Description

Allows an application to receive the ACTION_BOOT_COMPLETED that is broadcast after the system finishes booting.

Details

This permission is of low to moderate impact. It will allow an application to tell Android to run the application every time you start your phone. While not a danger in and of itself, it can point to an applications intent

Restart other applications

Hardware controls

URI: android.permission.RESTART_PACKAGES

Risk: HIGH

Protection level: UNKNOWN

Official Description

This constant is deprecated. The restartPackage(String) API is no longer supported.

Details

This permission is of low to moderate impact. It will allow an application to tell Android to 'kill' the process of another application. However, any app that is killed will likely get restarted by the Android OS itself.

Retrieve running applications

Hardware controls

URI: android.permission.GET_TASKS

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to get information about the currently or recently running tasks: a thumbnail representation of the tasks, what activities are running in it, etc.

Details

This permission is of moderate importance. It will allow an application to find out what other applications are running on your phone. While not a danger in and of itself, it would be a useful tool for someone trying to steal your data. Typical legitimate applications that require this permission include: task killers and battery history widgets. Other than that however, most apps should not need this permission.

Display system-level alerts

Hardware controls

URI: android.permission.SYSTEM_ALERT_WINDOW

Risk: HIGH

Protection level: DANGEROUS

Official Description

Allows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.

Details

This permission is of high importance. This permission allows an app to show a "popup" window above all other apps, even if the app is not in the foreground. A malicious developer/advertiser could use it to show very obnoxious advertising. Almost no apps should require this permission unless they are part of the Android operating system. An example of a system alert would be the alert you are shown when your phone or tablet is out of battery and is about to shut down.

Control vibrator

Development tools

URI: android.permission.VIBRATE

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows access to the vibrator

Details

This permission is of low importance. As it states, it lets an app control the vibrate function on your phone. This includes for incoming calls and other events.

Take pictures and videos

Development tools

URI: android.permission.CAMERA

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Official Description

Required to be able to access the camera device.

Details

This permission is of moderate importance. As it states, it lets an app control the camera function on your phone. In theory this could be used maliciously to snap unsuspecting photos, but it would be unlikely and difficult to get a worthwhile picture or video. However, it is not impossible to make malicious use of cameras.

Access location extra commands

Network Communication

URI: android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

Risk: MEDIUM-HIGH

Protection level: UNKNOWN

Official Description

Allows an application to access extra location provider commands

Details

The specifics of the extra commands here are a bit unclear. However, the usage of this permission indicates that an app wants to know detailed information about your location, and respond accordingly. This is often used with advertising and location-based and social-network services like Four Square, Twitter, Facebook or Google Places/Google+. It is recommended that you treat this permission with the same caution as the GPS location permission and assume the same implications to privacy apply.

Access mock location

Network Communication

URI: android.permission.ACCESS_MOCK_LOCATION

Risk: MODERATE

Protection level: DANGEROUS

Official Description

Allows an application to create mock location providers for testing

Details

This is a permission used for development of apps that make use of location based services. By creating "mock" (fake) locations, apps can test if their code works correctly depending on your location.This permission has no known sercurity considerations; Nor much use in a app released to the public.

Battery stats

Hardware controls

URI: android.permission.BATTERY_STATS

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows an application to collect battery statistics

Details

This permission is of little to no importance.

Bluetooth Admin

Your accounts

URI: android.permission.BLUETOOTH_ADMIN

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows applications to discover and pair bluetooth devices

Details

Bluetooth (Wikipedia: http://en.wikipedia.org/wiki/Bluetooth) is a technology that lets your phone communicate wirelessly over short distances. It is similar to Wi-Fi in many ways. It itself is not a danger to your phone, but it does enable a way for an application to send and receive data from other devices. Typical applications that would need bluetooth access include: sharing applications, file transfer apps, apps that connect to headset or wireless speakers.

Broadcast Sticky (Intents)

Hardware controls

URI: android.permission.BROADCAST_STICKY

Risk: LOW-MEDIUM

Protection level: UNKNOWN

Official Description

Allows an application to broadcast sticky intents. These are broadcasts whose data is held by the system after being finished, so that clients can quickly retrieve that data without having to wait for the next broadcast.

Details

The permission has to do with how applications "talk" to each other using a communication method called "Intents". While this permission is highly technical it is a relatively low importance. There are no know obvious malicious uses for this permission.

Change Configuration

Hardware controls

URI: android.permission.CHANGE_CONFIGURATION

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to modify the current configuration, such as locale.

Details

This is a permission that generally should not be granted to regular apps. Other than changing the locale (i.e. language), it is unclear what configuration changes this permission allows. As such, it should be treated with considerable caution.

Clear app cache

Hardware controls

URI: android.permission.CLEAR_APP_CACHE

Risk: LOW

Protection level: DANGEROUS

Official Description

Allows an application to clear the caches of all installed applications on the device.

Details

This permission is of low importance. It allows an app to clear the cache of apps on the phone or tablet. The cache is a place that an app stores recently used data for faster access. Clearing the cache can sometimes (very rarely) fix bugs related to those files. Clearing these files generally presents no risk other than to slow the performance of the phone or tablet (as apps will need to re-create the caches when used).

Disable Keyguard (lock screen)

(unknown category)

URI: android.permission.DISABLE_KEYGUARD

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows applications to disable the keyguard

Details

This permission is of medium-high importance. It allows an app to disable the "lock screen" that most phones go into after going to sleep and been turned on again. This lockscreen can sometimes be a password screen, or a PIN screen, or just a "slide to unlock" screen.

Expand status bar

Hardware controls

URI: android.permission.EXPAND_STATUS_BAR

Risk: MEDIUM-HIGH

Protection level: UNKNOWN

Official Description

Allows an application to expand or collapse the status bar.

Details

This appears to be a system permission -- not for use by regular applications. If you come across this permission I would beware of any app requesting it that is not an Android system app.

Flashlight

Development tools

URI: android.permission.FLASHLIGHT

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows access to the flashlight

Details

This allows apps to turn on or off the LED "flash" light used by the camera. This is a handy tool but usually of no risk itself.

Get package size

Hardware controls

URI: android.permission.GET_PACKAGE_SIZE

Risk: LOW-MODERATE

Protection level: UNKNOWN

Official Description

Allows an application to find out the space used by any package.

Details

This permission does not seem to have any risk associated with it.

Kill background processes

Hardware controls

URI: android.permission.KILL_BACKGROUND_PROCESSES

Risk: HIGH

Protection level: UNKNOWN

Official Description

Allows an application to call killBackgroundProcesses(String).

Details

This permission is a bit of a tricky one. Often this is used by what are called "task killers". These apps supposedly free system resources by closing apps running in the background. However the usefulness of such apps is minimal at best. They can help close an app that is misbehaving, however a user can already do that themselves through the Android settings under "Apps" or "Manage Applications". Conversely this permission has some potential to maliciously close anti-virus or other security related apps. As with anything I would treat this with caution. Few users should ever need an app with this permission. Rather, it could be an indicator of malicious intent (especially if not requested by a task killer or system performance tuning app).

Modify audio settings

Hardware controls

URI: android.permission.MODIFY_AUDIO_SETTINGS

Risk: LOW

Protection level: DANGEROUS

Official Description

Allows an application to modify global audio settings

Details

This permission is of low importance. Audio settings pose little to no risk to the device.

Format file systems

Your personal information

URI: android.permission.MOUNT_FORMAT_FILESYSTEMS

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows formatting file systems for removable storage.

Details

The primary danger with this permission is that it could be used to erase data from an SD card or other similar storage in your phone. This is also not a permission any normal app should need.

Mount / Unmount file systems

Your personal information

URI: android.permission.MOUNT_UNMOUNT_FILESYSTEMS

Risk: MODERATE

Protection level: DANGEROUS

Official Description

Allows mounting and unmounting file systems for removable storage.

Details

This permission just allows for connecting to SD cards for reading and writing. While not a risk itself, this is also not a permission any normal app should need.

NFC (Near Field Communication)

Your accounts

URI: android.permission.NFC

Risk: MEDIUM

Protection level: DANGEROUS

Continued On Page 9