Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

If you were to install a Home Screen application that does not give you access to the System Settings screen (to go to Manage Applications), and also does not let you launch Apps (such as the Market App or 3rd party install/unistallers), is there ANY way to uninstall such an application?

I know that Android requires your permission before letting a new App take over the home screen privilege. But say you're trying a newly published Launcher app that is buggy (or malicious). You are of course still going to tell Android it's ok to give this App the Home screen privilege. Now once it is installed, your phone is now effectively useless?

Is there a way for a typical end user (who doesn't have Eclipse/ADB) to get out of this situation? Other than doing a complete factory reset?

I realize there are ways to uninstall an App via ADB ("adb uninstall package.name")

But it seems like a typical end user is potentially screwed if they ever install such a malicious/buggy app. This seems like a gaping security hole in Android, no?

share|improve this question
    
I'd say remove the app from the SD card, if it was installed there, but I think this has been mentioned before with a better fix. –  glasnt Feb 28 '11 at 5:28
    
@glasnt Helpful suggestion, but I'm mostly wondering about the case when the launcher is installed to local storage, not SD. thanks. –  jpeskin Feb 28 '11 at 5:30
    
@glasnt: Launcher is typically not installable to SD card since a Launcher needs to be available when the SD card is removed. –  Lie Ryan Feb 28 '11 at 6:38
    
A situation like this happened recently due to developer error rather than malice. You might find some good information in this question: android.stackexchange.com/questions/4910/… –  Al E. Feb 28 '11 at 14:30
add comment

3 Answers

up vote 10 down vote accepted

Start your device in SAFE MODE and then uninstall the app that's causing problems. Rebooting will exit from Safe Mode. Here's how to access SAFE MODE in a few popular devices.

HTC devices with physical buttons:

  • Turn off your Android phone.
  • Press the Menu button on your phone.
  • While holding down the Menu button, turn on your device and keep pressing the Menu button until you see the lock screen.
  • Safe Mode should now be printed in the lower-left corner of your display. When in safe mode, Android does not load any third-party apps, and you can uninstall the application that gave you trouble from Settings > Applications > Manage applications.

Nexus One:

  • Turn off your Nexus. Remove the battery if it cannot be done the normal way.
  • Press the power button to start your phone, and right when the logo appears, press and hold the trackball. You should also be able to hold down the touch sensitive Menu button at this point, if you prefer that.
  • Keep pressing until you see the lock screen, and you should now be in safe mode.

Motorola Droid

  • Turn off your Droid and slide open the hardware keyboard.
  • Press both the power button and the Menu button on the keyboard simultaneously.
  • Keep holding down the Menu key until you see the “Droid Eye”, and you feel your phone vibrate.
  • Your Droid should start and say “Safe Mode” in the lower-left corner of the screen.

Samsung Galaxy S

  1. Power the phone off.

  2. Turn the phone back on while pressing and holding the Menu button.

  3. Keep holding the Menu button until the Home screen loads. The lower-left corner should say Safe Mode.

share|improve this answer
    
excellent answer. This does indeed allow one to disable a "test" malicious Home app that I developed to explore this issue. Thank you. –  jpeskin Feb 28 '11 at 22:59
add comment

To create such malicious Launcher it will need to:

  1. Disable Settings > Applications > Manage Applications
  2. Disable Settings > Applications > Development > USB Debugging
  3. Disable Market (to prevent you from downloading Home Switcher apps)
  4. Prevent all other Launcher-type application from opening (otherwise you can just start the other Launcher and go to Settings from there)
  5. Disable Terminal Emulator-type application (to prevent uninstallation by pm or rm-ing the .apk)
  6. ...others?

This seems like a gaping security hole in Android, no?

No. When security experts talks about a system having a good security, they don't talk about a stupid user doing stupid thing to his system. A stupid user giving untrusted program unwarranted privileges are social problems, not security problem.

Linux (and Android) is secure not because it is impossible mess the system up (you can, very easily, just type sudo rm -rf /). Linux is secure because a malicious program cannot mess up the system without the user's authorization and a user cannot mess the system up unless they have the appropriate privilege to mess up the system (a user with a root privilege can mess up the system in thousands of ways).

Unlike in some other OS, Linux (and Android) does not attempt to protect the user from doing something stupid (since such protection would also prevent power users from doing anything smart). It will blindly follow your order when you told it to destroy itself (as long as the user has the privilege to command the system to destroy itself).

The following sudo's first-time-sudoers lecture sums up the Unix/Linux way to security:

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.

In any case, if such malicious Launcher comes into the Market, we can be sure that Google will remove it from Market immediately with no delay (and probably issue a remote uninstall command). And if you install such Launcher from outside Market, then you are not a "typical user", you are responsible for your own if you're installing programs from outside Market.

share|improve this answer
    
Agreed, I would hope both comments and ratings would deter others from using such an application if it existed. –  Bryan Denny Feb 28 '11 at 14:31
1  
This isn't always true - I'd like to refer to the incident when popular homescreen app LauncherPro "expired". Those who hadn't updated to a newer version were locked out and had to use a round-about way to get back in and download a fresh update. The dev acknowledged his error and has dropped the idea of putting a "time-bomb" into his app. –  Sparx Feb 28 '11 at 14:34
1  
Your list of things that a malicious launcher must disable is misleading. When you create a launcher app replacement, those things are all disabled by default. You must actually purposefully include access to Settings in your launcher. Your point about this technically being a usability problem and not a security problem is fair. But that doesn't make this severe usability problem go away. Android wisely does protect (by denying root) the user from doing many stupid things. Educating the world is unrealistic. Problems like these are solvable (e.g. SAFE MODE mentioned below). –  jpeskin Feb 28 '11 at 22:58
    
@jpeskin: True, but if a Home Screen app does not have a list of apps (which, unless specifically disabled, includes Settings.apk and other stuffs); then most users would not be so foolish to check the "Set as Default" and they would be able to return to their old home screen by pressing Home button. This means a truly malicious Home Screen must trick the user to check the "Set as Default", which is only achievable by presenting a list of applications (and hoping the user did not notice all the apps that can be used to change Home Screens are missing). –  Lie Ryan Mar 1 '11 at 9:39
    
@jpeskin: The case with LauncherPro is interesting, as it is a very fine Home Screen app which turned rogue due to a bug in the expiry code, and the bug only shows itself some time after being installed (which means most people would have checked the Set Default). But this incident does highlight that due to the special position of the Home Screen (as the app that "owned" the Home button), a malicious Home Screen can cause grieve to users and practically take over the device. We'll see if Google will do something about this in future releases. –  Lie Ryan Mar 1 '11 at 9:59
add comment

For the "typical end user", the easiest ways probably are:

If the "rogue" was installed from Google Play:

  1. On a computer, open the Play Store Website with your favorite web browser
  2. Log in with your Google Account credentials
  3. Hit the "My Android Apps" tab at the upper-right of the page
  4. Look for your "rogue" app
  5. Hit the trashcan symbol next to it

This will uninstall the selected app. Of course, this only works for apps installed via Google Play.

If you side-loaded the "rogue" (installed it from another source)

If you side-loaded the "rogue", you'll need a couple of more steps. Follow 1+2 from above list, then...

  1. Search for any other homescreen/launcher app
  2. Hit the "Install" button on its page
  3. If you've got multiple devices attached to this Google account, select the one with the rogue app
  4. Hit "OK"
  5. Within the next few minutes, the new launcher should be installed on your device. Until then, you might want to periodically switch it on to ensure it stays "awake" (and connected to the network), which might speed up the process a little
  6. Once the installation has finished, hit the Home button.
  7. As Android noticed the new launcher app, a pop up will ask you to chose which launcher to start. Select any launcher you want, just not the rogue one.
  8. As you now have a fully functional launcher running, you can take the usual steps to remove the "rogue" app.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.