Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Suppose I want to run some program which requests too many permissions. For example, record from the microphone or read IMEI of my phone. However, there are no practical explanation why recording from the mic or IMEI number is needed for this particular application, except for data mining.

I want to try this app, but restrict its permissions. For example, if it reads IMEI, it should get random IMEI(but the same every time). If it tries to read the mic, it should get silence.

Some other interesting permissions:

  1. Phonebook read/write access - returns zero contacts, pretend that write is OK, but actually do nothing.
  2. Send SMS - pretend that SMS is sent, but do nothing.
  3. Get list of visible Wi-Fi networks - return zero networks.

Obviously the tool should require a rooted phone. Are there any such tools?

share|improve this question
    
I have been asking this question on stackexchange, but was directed here as this site has a wider android audience. –  Denis Nikolaenko Dec 1 '10 at 23:23
5  
I have never seen anything like this but I don't see why it couldn't be done. Its a good idea. –  Matt Dec 2 '10 at 1:56
1  
Could you use the emulator in the developer SDK to accomplish a lot of this? –  Al E. Dec 2 '10 at 15:09
1  
Basically, yes. Using emulator as a sandbox is possible. But what if I want to run an app on the physical phone, but keep my privacy? –  Denis Nikolaenko Dec 2 '10 at 15:35
    
I know this question is old, but can you elaborate what context make you you want to test some malicious app on your own personal physical device and answer bogus personal data ? To me, current cyanogenmod solution (reject calls, do not produce fake data) seems enough. –  Stéphane Gourichon Aug 21 at 18:29

14 Answers 14

Whisper Systems has come out with a custom ROM that has this exact feature: http://www.whispersys.com/permissions.html. As DarthNoodles mentions, it has to be done at the system level rather than the app level, which is how it is implemented in WhisperCore. The current version isn't able to block all of the permissions available on Android, but they are working on supporting more of them.

share|improve this answer
    
Source code is available only after purchase... –  Denis Nikolaenko Sep 24 '11 at 13:04
up vote 11 down vote accepted

CyanogenMod 7.1 has exactly this feature, but without faking data, only failing, if the app accesses the API. Proposition for faking the IMEI was rejected. Faking other data, like contacts, is currently under discussion.

share|improve this answer
    
Steve Kondik explains why it was rejected in this post: plus.google.com/+SteveKondik/posts/iLrvqH8tbce Extract: "I rejected these patches since they create a hostile environment for applications, and that's not the direction I want to see CM go. (...) developers who don't want their apps running in unpredictable environments. (...) I think these patches are just more security theater and don't really solve a problem. Why do you want to run malicious applications anyway?" –  Stéphane Gourichon Aug 21 at 18:25

Not an absolute solution to your problem, but there is an app in the android market which caters to your needs. It also necessarily requires better knowledge about permissions and also a rooted device.

Permissions Denied is an app which allows you to effectively control the permissions that apps which are installed onto your phone, via the market or some other source. Also be aware that denying an app a permission that it is requesting may result in the app Force Closing. (hence requiring you to have better knowledge on how to use it)

Note : This app Requires Root Access. This app will not work on all device.

share|improve this answer
1  
CyanogenMod is still better in this area, the app is currently flaky. –  Denis Nikolaenko Jul 30 '11 at 23:43

This is no Sandbox Application, but perhaps it's also interesting for you, if you havn't already heard about it.

Some scientists startet the project Taintdroid. Realtime Privacy Monitory for Android

share|improve this answer

It's a logical solution for a potential problem and a long time irritation of mine.

However, you must remember that whatever solutions are available for a security application would also be available for a malware app. If a security app could block net access then a malware app could block it also, stopping a security app from updating data files for instance.

It needs to be done at the system level, not as another application.

See my post here for my thoughts.

share|improve this answer
3  
Such tools would require root access to the phone, if you grant it, should have an ultimate trust in the tool, like "Permissions Denied". If you grant root access to a random application from the market, you just shot yourself in the foot :) –  Denis Nikolaenko Aug 3 '11 at 3:16

LBE Privacy Guard appears to be a very promising solution with interactive features to block or allow application activity on the fly.

share|improve this answer

There is an ongoing research on this this subject. A non yet released proof of concept is implemented for some of the privacy sensitive APIs exactly as I proposed. The privacy manager is called TISSA, short for Taming Information-Stealing Smartphone Applications.

share|improve this answer

There is an App Shield application. It essentially repackages .apk with permissions removed from manifest. Brilliant idea for stock, non rooted phones. Subject to crashes (force closes), though, as with current CyanogenMod approach.

share|improve this answer
    
This sounds great, but the link is dead and searches on Google Play find nothing. Is App Shield still available, and if not, is there a reason why that we should know about? –  user568458 Jun 2 '12 at 14:20

There is a Privacy Blocker (paid) and Privacy Inspector (free) applications. Privacy Blocker does a static analysis of applications for sensitive API calls and rewrites these calls into stub ones which return fake data. As a result a new .apk with rewritten application is generated and installed. Privacy Inspector is an app which only reports the use of sensitive API calls.

share|improve this answer

MockDroid is another academic firmware with data faking capabilities.

share|improve this answer

A translated version of the Chinese version of LBE is available on XDA developers, and it works very well on Jelly Bean. Apparently the Chinese version is still actively developed.

http://forum.xda-developers.com/showthread.php?t=1422479

share|improve this answer

There is an excellent tool PDroid. It's both an App and a set of ROM patches, which enable intercepting and faking permission requests. Here are the PDroid Jellybean ROM Fork patches

share|improve this answer

XPrivacy is a module for XPosed framework which does exactly what you need. It is free and open source. Works on rooted devices.

Download framework apk from here:

http://repo.xposed.info/module/de.robv.android.xposed.installer

Module apk:

http://repo.xposed.info/module/de.robv.android.xposed.installer

Source:

https://github.com/M66B/XPrivacy?mobile=0#xprivacy

share|improve this answer

I'm fairly certain that tool that you seek doesn't exist yet. But your idea is great. Few point though;

ofc; app can freely read and write it's own app directory

giving fake read acces : for every possible read (and there's a lot app can try to read) default response should be generate; lot a work but doable

however; giving fake write access is lot harder; what if it uses sd card to store big temp files; like bitmaps. On unrooted phone; only place app can write is sd card; and using content provider (for stuff like contacts, and calendar). And app desiger isn't expecting to fail in writing data; so app could crash.

Good thing is that the worst that could happen is that app might crash.

share|improve this answer
    
Why down vote? At Dec 2010 these tools did not really exist. –  Denis Nikolaenko Aug 3 '11 at 20:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.