[Android General] Diablo67:
Android Permissions & Security Explained Continued...

Continued From Page 8

Page 9 Of 10

Official Description

Allows applications to perform I/O operations over NFC

Details

NFC stands for Near Field Communication. This is a technology like Bluetooth that enables short range communication between two devices or the reading of NFC "tags". The distance which NFC is able to work is only a few centimeters so that devices (or a device and a tag) must effectively be touching each other to communicate. Due to the distance, this technology is not particularly dangerous. However it does present a small risk and it is something that should used with caution.

For more info: http://en.wikipedia.org/wiki/Near_field_communication

Process outgoing calls

Your location

URI: android.permission.PROCESS_OUTGOING_CALLS

Risk: VERY-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to monitor, modify, or abort outgoing calls.

Details

This permission is of high importance. This would allow an app to see what numbers are called and other personal info. Generally this permission should only be seen on apps for VOIP (Voice Over Internet Protocol) like Google Voice or dialer replacement type apps.

Read sync stats

Hardware controls

URI: android.permission.READ_SYNC_STATS

Risk: MODERATE

Protection level: UNKNOWN

Official Description

Allows applications to read the sync stats

Details

This permission is related to "Read sync settings" but not particularly dangerous itself. There is a minor risk that some personal information could be gleaned from the sync stats, but the information is unlikely to be valuble. Sync in this case relates to syncing of contacts and other types of media on the phone.

Record audio

Development tools

URI: android.permission.RECORD_AUDIO

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to record audio

Details

While this permission is not typically dangerous, it is a potential tool for eavesdropping. However recording audio has legitimate uses such as note taking apps or voice search apps. As a side note recording audio is typically a significant drain on the battery.

Set alarm

Hardware controls

URI: android.permission.SET_ALARM

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows an application to broadcast an Intent to set an alarm for the user.

Details

This permission seems to be of low risk because it doesnt allow the setting of the alarm directly. Rather it allows the opening of the alarm app on the phone.

Set time zone

Hardware controls

URI: android.permission.SET_TIME_ZONE

Risk: LOW

Protection level: DANGEROUS

Official Description

Allows applications to set the system time zone

Details

This permission poses little, if any, risk

Set wallpaper

Hardware controls

URI: android.permission.SET_WALLPAPER

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows applications to set the wallpaper

Details

This permission poses little, if any, risk

Subscribed feeds read

Development tools / Your personal info

URI: android.permission.SUBSCRIBED_FEEDS_READ

Risk: MEDIUM

Protection level: UNKNOWN

Official Description

Allows an application to allow access the subscribed feeds ContentProvider.

Details

This would give an app access to RSS feed that you have subscribed to. If you dont subscribe to any RSS feeds this permission is of little risk. If you do, this permission is akin to letting an app have access to your broser history. It could glean interests and preferences and other semi-personal information.

Subscribed feeds write

Development tools / Your personal info

URI: android.permission.SUBSCRIBED_FEEDS_WRITE

Risk: LOW-MEDIUM

Protection level: DANGEROUS

Official Description

(No developer documentation is available for this permission)

Details

This would give an app access to RSS feed that you have subscribed to. If you dont subscribe to any RSS feeds, this permission is of little risk. If you do, this permission is akin to letting an app have access to your broser history. It could glean interests and preferences and other semi-personal information.

Use SIP

Your accounts

URI: android.permission.USE_SIP

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to use SIP service

Details

SIP stands for Session Initiation Protocol. It is a technology mostly used for making video and voice calls over the Internet. While not a major security risk it should be treated with almost as much caution as the standard "make phone calls" permission.

Write secure settings

Hardware controls

URI: android.permission.WRITE_SECURE_SETTINGS

Risk: VERY-HIGH

Protection level: DEVELOPMENT

Official Description

Allows an application to read or write the secure system settings.

Details

This permission should only be seen on Android system apps (and possibly wireless carriers or hardware manufacturer pre-installed apps).

Write SMS

Services that cost you money

URI: android.permission.WRITE_SMS

Risk: HIGH

Protection level: DANGEROUS

Official Description

Allows an application to write SMS messages.

Details

This permission appears to be an offshoot from the "send SMS" permission. This should allow an app to write, but not send an SMS message. Users should still be cautious of this permission however. Many kinds of malware lure users into sending SMS to special for-pay numbers costing them money.

Write sync settings

Your messages

URI: android.permission.WRITE_SYNC_SETTINGS

Risk: MEDIUM

Protection level: DANGEROUS

Official Description

Allows applications to write the sync settings

Details

This permission relates to backup and sync of certain types of information like contacts. This allows an app to write settings for how that account and the data are sync and backed up. This is a common permission for social services or contact managers or any other type of app with an account associated with it. Alone, this permission doesn't allow an app access to contacts or other sensitive data. Rather, it just relates to how that data is backed up. Nevertheless, care should be taken as always.

Read profile

Development tools / Your personal info

URI: android.permission.READ_PROFILE

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Official Description

Allows an application to read the user's personal profile data.

Details

This a new permission that relates to a special new "Me" contact you can create in your phone or tablet as your own profile.

Install Shortcut (Android Launcher)

Hardware controls

URI: com.android.launcher.permission.INSTALL_SHORTCUT

Risk: MODERATE-HIGH

Protection level: UNKNOWN

Details

This is a custom permission for the default Android Laucher (the home screen). This permission would allow an app to put an icon or shortcut there. While not dangerous, this can sometimes be a sign of a potentially malicious or adware app. For more on adware, see the guides section of PocketPermissions.

Read external storage

Your personal information

URI: android.permission.READ_EXTERNAL_STORAGE

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows an application to read from external storage.

Details

This permission is granted to all apps by default.

Read SMS

System tools

URI: android.permission.READ_SMS

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Details

This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS replacment" apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.

Write call log

Your location

URI: android.permission.WRITE_CALL_LOG

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Details

This permission is not much of a danger by itself, but rather could be used to hide other malicious behavoir. However it has a legitimate purpose for dialer replacements or voice over IP apps (like Google Voice).

Write profile

Development tools / Your personal info

URI: android.permission.WRITE_PROFILE

Risk: MODERATE-HIGH

Protection level: DANGEROUS

Details

This a new permission that relates to a special new "Me" contact you can create in your phone or tablet as your own profile.

Read social stream

Development tools / Your personal info

URI: android.permission.READ_SOCIAL_STREAM

Risk: HIGH

Protection level: DANGEROUS

Details

This permission is very important. It is a new permission introduced with Android 4.0 (Ice Cream Sandwhich). This permission would allow an app to read updates from social networking apps like Google+, Twitter, and Facebook. By granting this permission you are giving an app the ability to read not only your information, but any updates posted by people in your social circles.

Add voicemail

System tools

URI: com.android.voicemail.permission.ADD_VOICEMAIL

Risk: MEDIUM-HIGH

Protection level: DANGEROUS

Details

This seems to be a new permission related to Android's new centralized voicemail system. It would be an unusual means for an app to use this permission maliciously. However few apps should need it and, as always, it should be treated with caution.

Authenticate Accounts

Your messages

URI: android.permission.AUTHENTICATE_ACCOUNTS

Risk: VERY-HIGH

Protection level: DANGEROUS

Details

This permission is of high importance. It allows an app to authenticate credentials (such as passwords). Typical uses of this would be if an app had it's own type of account on your phone such as Google, Facebook, or Twitter.This permission is closely related to the Account Manager permission. Both are typically requested together.While this doesn't directly give an app access to your personal information or passwords, it does present a security risk for phishing (tricking the user into revealing their password). For more on phishing, see the Guides section of PocketPermissions)

Read email attachments

Development tools / Your personal info

URI: com.android.email.permission.READ_ATTACHMENT

Risk: HIGH

Protection level: DANGEROUS

Details

This is a custom permission for the default Android email app (i.e. not Gmail). This permission should be treated with great caution. Many email attachments contain highly sensitive and personal or financial information.

Read user dictionary

Development tools / Your personal info

URI: android.permission.READ_USER_DICTIONARY

Risk: LOW

Protection level: DANGEROUS

Official Description

Allows an application to read the user dictionary.

Details

This would allow an app to read words added to your custom dictionary. Oftentimes this is abbreviations like "brb" that you might add for typing text messages. Unless you save personal information in your dictionary, this permission is of almost no risk.

Write user dictionary

Hardware controls

URI: android.permission.WRITE_USER_DICTIONARY

Risk: LOW

Protection level: UNKNOWN

Official Description

Allows an application to write to the user dictionary.

Details

This alows an app to add custom words to your user dictionary. For example, the common acronym "brb" for "be right back".

Receive SMS

System tools

URI: android.permission.RECEIVE_SMS

Risk: HIGH

Protection level: DANGEROUS

Official Description

Allows an application to monitor incoming SMS messages, to record or perform processing on them.

Details

This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS replacment" apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.

Receive MMS

System tools

URI: android.permission.RECEIVE_MMS

Risk: HIGH

Protection level: DANGEROUS

Official Description

Allows an application to monitor incoming MMS messages, to record or perform processing on them.

Details

This permission is mostly a privacy concern. Any app that can read your MMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply "SMS/MMS replacment" apps (such as Handcent) and would naturally need this permission to function.

Install DRM

Hardware controls

URI: android.permission.INSTALL_DRM

Risk: MODERATE-HIGH

Protection level: UNKNOWN

Details

DRM stands for Digital rights management. Typically this permission is not particularly dangerous itself. However, it is a permission related to controlling access to medi such as books, audio video, and more. Due to its purpose to control access, I would be especially careful installing any app requesting it.More info: http://en.wikipedia.org/wiki/Digital_rights_management

Add system service

Hardware controls

URI: android.permission.ADD_SYSTEM_SERVICE

Risk: CRITICAL

Protection level: UNKNOWN

Details

This permission should only be given to Android System apps (and possibly to wireless carrier or hardware manufacturer pre-installed apps)

Access WiMax State

Your accounts

URI: android.permission.ACCESS_WIMAX_STATE

Risk: LOW-MODERATE

Protection level: UNKNOWN

Details

WiMax is a technology developed for "4G" data and internet speeds on mobile devices. This permission allows an app to see if it is currently connected to a wireless network that uses WiMax. There is no significant risk associated with this permission.

Change WiMax state

Your accounts

URI: android.permission.CHANGE_WIMAX_STATE

Risk: MODERATE

Protection level: DANGEROUS

Details

This permission allows an app to turn on or off the WiMax radio. WiMax is a type of "4G" wireless connection like LTE. This permission essensially allows an app to turn on or off 4G.

Read instant messages (IM)

Development tools / Your personal info

URI: com.android.providers.im.permission.READ_ONLY

Risk: HIGH

Protection level: UNKNOWN

Details

This is apermission realated to reading instant messages, such as those on GooleTalk.

RECEIVE

(unknown group)

URI: com.google.android.c2dm.permission.RECEIVE

Risk: LOW

Protection level: UNKNOWN

Details

C2D stands for Cloud to Device Messaging. This is a push notification technology that is being phased out for a similar technology called GCM. (Google Cloud Messaging). This permission is of little to no risk.

In-app billing

Services that cost you money

URI: com.android.vending.BILLING

Risk: CRITICAL

Protection level: UNKNOWN

Source

Continued On Page 10