I've noticed quite a few apps requesting the RECEIVE_SMS
permission. Two things are clear to me here:
RECEIVE_SMS
enables an app to "snap" incoming SMSREAD_SMS
just applies to SMS already stored
As some of the apps just were asking for RECEIVE_SMS
, but not for READ_SMS
, I got curious: this seems to imply RECEIVE_SMS
is not only targeted at the receiving part, but the app can also do what it wants with the received message – e.g. read it, then throw it away silently (so the user doesn't even notice there was an SMS – which might be the way TAN Trojans act to snap identifiers for online banking transactions).
But would it also be possible for such an app to "intercept" the message, i.e. receive it, read it (and process its content in any way, e.g. forwarding it by other means such as via IP), and then pass it on as if nothing had happened? In other words: Can it spy on the user this way?