[Security Discussion] Diablo67:
Android Permissions & Security Explained

This guide aims to provide the basic info most people want to know about the security of their phones, and when to download, and when not to download applications from the Android Market.

It's my hope that this will help people make more informed decisions and be safe about their application usage, privacy, and data. It is my firm belief that Android is a fundamentally safe platform. With some common sense, diligence, and the right knowledge of the potential threats, users can rest assured and enjoy their devices more thoroughly.

While most of these tips will apply to any of the new app stores and markets now available for Android, this guide is written specifically for Google's original Android Market.

Also, while this guide attempts to be as comprehensive as possible, there may be errors or misjudgments, or just opinions that are subjective. Please read it with the idea in mind that it's just a part of the information you may want to consider when downloading your apps.

Deciding what to download is ultimately up to you, and that's the most important thing you'll need to remember.

Background about Android

The first thing when understanding the security of your phone is to know a little bit about what makes it tick. Android is a 'lite' version of Linux with most applications that you download from the market written in Java.

This is important to know because it means Android is very unlikely to ever get a 'virus' in the traditional sense. Part of the reason is because Linux is a fairly secure operating system that protects various parts of itself from other parts. This is similar to how Windows has admin accounts and limited user accounts. Because of this protection, applications downloaded from the market do not have access to anything by default. You must grant them permission for each activity they want to perform when they are installed. This is a very important point which we will address a bit later. Also due to some bad choices by Google, there are a few exceptions to this rule that we'll talk about in the permissions section.

Nevertheless, while Android is very unlikely to get a 'virus', that does not mean you are completely safe from 'malware', 'spyware', or other harmful types of programs.

Anti-virus

The efficacy of anti-virus apps on Android is a controversial subject on even the best of days. Needless to say, there are some very differing opinions on the necessity of having anti-virus software protecting your phone. Both sides of this debate have some credible and respectable reasons for their choice, so I will try and present both sides as objectively as I can. In full disclosure though, I personally do not use anti-virus on my phone. That's a personal choice I made. Plenty of security experts whom I respect do chose to use anti-virus on their phones. So ultimately this will be a choice that is yours alone to make and not something where you should take cues from other people. That said, here are the pros and cons of each side as best as I know them.

One thing to remember though, is that each side may have some irrational or sensational arguments. These stem from either a sense of emotional justification or a vested interest in selling software. Put simply, neither side of the debate is above bad arguments and unintentional or intentional faulty logic.

Benefits

- Will protect you from all past threats

- May protect you from a future threat

- Often can have additional features for privacy and data protection

- May have features to protect your phone if it is lost or stolen

Drawbacks

- May waste system resources like battery and memory

- It's hard to protect from future/unknown threats

- Can potentially cause serious harm to the OS (very rare but not unheard of)

- May provide a false sense of security and encourage risky behavior

Types of Dangerous Programs

The most common threats from Android applications are:

1) When the app tricks the user into giving it permissions it does not need to do its job.

2) When the app hides malicious code behind legitimate permissions.

3) When the app tricks the user into entering in personal information or sensitive data (such as a credit card number).

There are various ways malicious developers (also known as hackers or crackers) accomplish this. We'll briefly define each kind just to have a common understanding of the terms.

Malware

Malware generally is an all-encompassing term used to describe any harmful program. This includes spyware, viruses, and phishing scams. Sometimes the older term 'virus' is used in this context, but malware is now considered more accurate.

Spyware

Spyware is used to describe software or applications that read your information and data without you actually knowing it and reporting it back to some unknown third party for nefarious purposes. Oftentimes this includes keystroke loggers to steal passwords or credit card information. Some people include certain types of Advertising tracking in this category (sometimes called Adware, see below). However that's a much larger debate we wont cover here.

Phishing

Phishing and spyware are closely related. They work on a similar principle: tricking the user and sending user information to a 3rd party to steal it. The difference with phishing however, is that the application (or website) will pretend to be from a trusted source to try and 'trick' you into entering in your details. Contrastingly, spyware would try to hide itself from being known to the user. One way to think about the difference is that phishing is masquerading while spyware is hiding, but the end goal of stealing your data is the same.

An example of this would be an app or website pretending to be affiliated with your bank or Paypal or your email provider (Gmail, Hotmail, Yahoo). However it can, and does, include any service where someone might want to steal your identity or password.

There have been known successful phishing attacks related to at least one bank on Android.

Virus

The definition of virus used to be more all-encompassing. These days that term has been replaced by malware. Virus is more typically used to describe a specific type of software that takes control of your operating system and either damages it, or uses it for its own purposes. An example might be when a virus sends emails to everyone in your email address book. Again this is the type of program least likely to be a problem for Android.

Trojan Horse

A trojan horse is really just a specific type of virus. It merely refers to the idea that the app pretends to be something useful or helpful or fun for the user while actually causing harm or stealing data. This term is often used to describe spyware and phishing attacks as well.

Adware

Adware is typically a bit of a grey area. Sometimes this is also called nuisance-ware. This type of application will often show the users an excessive amount of advertising in return for providing a service of dubious quality to the user. However, this type of program can often be confused with legitimate ad-supported software, which shows a mild to moderate amount of advertising while providing a useful service that the user wants. Because it can be hard to tell the difference, there exists a grey area from most anti-virus companies as to how to handle adware.

How to check Permissions

When you install an application the Market will tell you all of the permissions it needs to function. These are important to read. Permissions can give you an idea if an application is asking for more than it needs to function properly. While some legitimate apps often ask for more permissions than they need, it should at least raise an eyebrow. Again this is just part of what you should consider when deciding if an application is safe and good quality.

How to Protect Yourself

There are no full-proof ways to avoid all bad situations in the world.But, any sane person with a reasonable head on their shoulders knowsthat a few good habits can keep you safe for a long, long time inwhatever you do. Here are a few tips I have learned from many years as aprofessional software developer and from reading many Android forumsthat have many people smarter and more knowledgeable than I aboutAndroid.

Read the comments in the Market

This should go without saying. Before you download any applications, besure to read the comments. Don't just read the first three either, clickthrough and see what people are saying. This can also help youunderstand how well an app works on your particular phone (and yourparticular version of Android). Comments should also be read EVERY timeyou update an app.

It's also important to note that bad apps can sometimes"game" the comments and ratings. There are some unsavoryservices that provide thousands of fake comments for apps and they areprobably more common than you think. See the section on TheCommunity for more on identifying these types of fake comments.

Check the Rating

Any app that fails to maintain above 2.5 stars is likely not worth yourtime. If you are brave enough to be one of the first few to download anapp, this does not apply to you. Nevertheless, almost all good apps havebetween 3 and 5 stars. To me, this is just a general rule to helpfind quality apps.

Check the permissions

There are many things an app can do to, and for, your phone. Butanything an app can do is told to you when you download and install it.Before you download and install an app, you will be shown a list ofpermissions the application is requesting. Read them. Try yourbest to understand them in terms of what the application is supposed todo for you. For example, if you download a game of checkers, and theMarket warns you that it wants to be able to read your contacts, youshould think twice and probably not download it. There is no sanereason a game of checkers needs to know your friend's phone numbers.

In the Permissions section you can read a list of some of the mostcommonly used permissions. The list explains how important they are,what they do, and notes some examples of apps that might legitimatelyneed the permission. This should help you get a basic understanding ofwhat to allow, and when to skip, an app.

Check the developer's website

Make sure the developer has a website and not just some blog. This isoften a good indication of quality as well as safety. If the developercares about their app they will likely have a relatively nice lookingwebsite (or, if they are open source, a site on Google Code or somethingsimilar). Note: sites on Google code are NOT verified or approved byGoogle. However, open source is usually (but not always) morelikely to indicate a safe application.

NOTE: This is not a definitive indicator if a developer is good or bad,just one more piece of information you can use. There are a lot ofexceptions to this particular rule, as a lot of good developers mightnot have anything more than a blog, and a lot of bad developers couldjust point to a nice looking site they have no affiliation with.However, the developer's website can be helpful just as an extra pieceof information you can use in making your decision about the developeror app.

Updating applications is the same as installing them fresh

Each time you update an application on your phone, you should use thesame diligence as if you were installing it for the first time. Rereadthe permissions to see that it is only asking for what it needs and nomore. Reread the comments to see if anything has changed in the opinionsof the users and to see if it still works for your phone. If you seethat an application says Update (manual) next to it, that means thedeveloper has changed the permissions that they are requesting. This isnot necessarily a bad thing -- but it should indicate that you shouldpay a bit closer attention to the permissions and re-evaluate them asneeded.

Privacy

Wi-Fi

One of the things to remember when trying to keep yourself safe is to be very careful with public Wi-Fi. Whenever you connect to the internet through a public Wi-Fi, you should never use any website that requires a password to sign into. The danger here is because you have no idea who is connecting you to the website. A good analogy would be like trying to mail a letter to your friend by giving it to a stranger in the street. For more info read: Man-in-the-middle attack(Wikipedia). There is also a risk that applications may be transmitting data in the background over that Wi-Fi connection about you without encrypting it. This is also true of any applications over any internet connection however. And while there are some good ways to secure your phone, I personally don't use any public Wi-Fi at all. This may be seen as extreme in some circles, but I believe it to be safest route (although somewhat limiting).

SD Cards

There isn't much to say about SD cards except that all users should remember that they are not a safe place to store personal information. This can be something as simple as a backup/export of your contacts.

The reason the SD card is not safe is that nearly all applications can read any file they want from the SD card. Most personal info such as contacts is stored internally in protected databases however, so this shouldn't be a huge concern for most people, but it's helpful to keep in mind.

GPS and Network Location

There is a lot of information online and in various books about why letting yourself be tracked has potential consequences. However, there are a lot of useful features that apps can provide with location tracking information. You should treat location tracking with care and be sure to give it only to parties your trust. Google Maps would be a great example of this.

Advertising and location tracking

There is a trade-off that some people will consider making with regards to location tracking. Some advertisers would like to have location information on you in order to show you local advertisements and coupons. In exchange, you get free use of an app such as a game. This is a decision you will need to make for yourself. I personally would not make this trade off, but some people very knowledgeable about security are very comfortable making it.

permissions

When you install an application the Market will tell you all of the permissions it needs to function. These are important to read as it can give you an idea if the application is asking for permission to do more than it needs. While some legitimate apps often ask for more permission than they need, it should at least raise an eyebrow when deciding if an application is safe and of good quality.