Dangers of Apps running in “Hidden mode”?

Question

I have downloaded an app to record all my calls. The app is working great but the trouble is that it doesn't shows up under the "Ongoing" in the notification bar nor does it shows up in "active applications" in the task manager also they do not require root access to run. I have tried many different apps that does the same thing. I have a rooted Samsung Galaxy Y phone running android 2.3.

What bothers me is the thought - "It's possible that the chess playing app(say) that I have in my phone, also records my calls and send it to remote servers - without my knowledge"

There is a posibility of giant security and privacy compramise here.

My question is: 1. Are there any similar loopholes that can be dangerous? 2. What should I do as an android user? 3. What has Google done/planning to do to prevent such apps in Google Play?

Answer 1

1) Are there any similar loopholes that can be dangerous?

They are not actually loopholes. They are ignorance of the user. For any Android app to be able record your calls, needs these permissions: (This is a code snippet from manifest XML file.)

<uses-permission android:name="android.permission.READ_CONTACTS" />

<uses-permission android:name="android.permission.READ_PHONE_STATE" />

<uses-permission android:name="android.permission.RECORD_AUDIO"/>

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

While installing apps you will see something like this on Google Play: Permissions: Read Contacts, Read Phone State, Record Audio, Read and Write to External Storage. (Something like that.)

2) What should I do as an android user?

So, when you install an App, you need to carefully see what permissions the App is asking for? Is it really needed for what the app is supposed to do? All you need to do is be careful when installing an App, see that you don't grant too many unwanted permissions.

3) What has Google done/planning to do to prevent such apps in Google Play?

They have already created permissions! No app can access things outside of what permissions it has been granted!

Hope this answers your doubts... :)

PS: Here's story related to your questions. There are already things which are recording calls.