Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 3 down vote favorite
2

There was an app, App Shield (since removed from the Android market, here's a description on Android Zoom) with a unique feature that allowed a non-rooted Android user to remove permissions from other apps. It was designed to allow people to deny specific permissions when those permissions were for features they weren't planning to use.

My question is: What specific security risks (if any) does/did App Shield pose?

I'm looking for specific facts and references to what App Shield does, from people with specific expertise of Android security, how Android apps function, and App Shield's specific features and functionality. The only information I could find in my own research was of uncertain reliability or based mostly on opinion.

Any facts on the specific reasons given when the app was pulled will be useful background, but the question is about what specific security risks there are with that app.

Please focus specifically on App Shield. I'm aware that:

  • ...a hypopthetical app that modified another app could write in malware features. I'm not asking about a hypothetical app, I'm asking specifically about App Shield
  • ...App Shield's functionality is controversial and touches on a debate about the merits of the Android permissions system and what Android apps should and shouldn't do. I'm not interested in that subjective debate and controversy. I'm asking about specific risks in App Shield.
  • ...there are always security risks with apps not on the market. I know about this, I'm asking specifically about the original App Shield app.
  • ...an App Shield user could break the apps they modify or cause them to crash by removing a permission that that the app then tries to use. That's unrelated, I'm asking about security risks.

My original wording of this question went into a bit more detail on why I was interested, and it has a very rough summary of my research and efforts to establish the story of what happened with App Shield. Apparently that sort of thing is too subjective. But check the edit if you want more context.

A correct answer might look like this:

"App Shield is unsafe because apps it repackages are ( placed outside of X path / lose Y protection / changed in a subtle way that shouldn't be described on a public site ) leaving them vulnerable to being modified by ( other apps that have Z permission / some other type of activity ). The malware-modified app will be able to ( gain any permission / use only its existing permissions but in malicious ways / do anything ). So it ( is / isn't ) possible to use App Shield safely ( but only if ... )"

...or...

"The original code of App Shield was largely safe because ..., but it could become dangerous if you ... or ... and I ( would / wouldn't ) normally advise against it because .... It is possible to use it safely if .... Apps like App Shield are forbidden on the market because modifying other apps is against the Android Developer terms, and apps like App Shield could be used to turn other apps into malware, ( but / and ) the original App Shield code is largely ...."

share|improve this question
1  
If App Shield repackages apps it changes the the app's signature thus you will not be able to update officially. To me it seems counter-intuitive to panic over an app being able to send texts but allowing another to do modifications to other apps. – Richard Borcsik Jun 2 '12 at 18:12
1  
@MatthewRead Please explain what is speculative or subjective about asking whether a specific app is a security risk or not. The question of why Google removed it from the market is of a clear question of fact involving specific expertise of specific events. The question of what risks there are specifically in one app is a factual question involving facts and reference to that app's functionality and specific expertise on Android security and the workings of the Android API. I'll rephrase the question as there's clearly some confusion. – user568458 Jun 3 '12 at 9:06
1  
Closing questions about specific security risks as subjective sets a precedent that Android security is somehow not an exact science. This is something that should be explained and discussed on meta: meta.android.stackexchange.com/questions/927/… – user568458 Jun 3 '12 at 11:53
1  
@RichardBorcsik that's exactly why I asked this question. I don't have the expertise to judge how much of a security risk the methods used by App Shield are. That's why I'm asking about them. There are people in this community who do have that expertise and could explain how much of a risk it is with reference to facts about what this app does and what the implications are. (p.s. re SMS: android.stackexchange.com/questions/10115/… I'd rather lose the ability to automatically update one app than hand an unknown developer permission to do that) – user568458 Jun 3 '12 at 12:02
1  
@Cerberus It was closed randomly by a moderator (Matthew Read) who misread the original wording of the question then, when challenged, invented excuses to cover up his mistake. It's quite sad really. See the meta link above. A main excuse he gave was to claim no-one else would ever be interested, so please join the discussion and see if that gets this re-opened. He might just ignore you like he ignored me, in which case, we've got a good case to put in a complaint. This Read guy clearly thinks he's spent so much time on this site that the rules no longer apply to him. – user568458 Jul 14 '12 at 9:39
show 4 more comments

closed as not constructive by Matthew Read♦ Jun 2 '12 at 20:40

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.