Can an app run code if you don't open it?

Question

Can an app run code if you don't open it?

As part of this question, the topic of an app downloading data without ever being explicitly opened by the user was mentioned briefly.

It got me thinking: is it trivial for an app to run code without ever being opened by the user?

Obviously, an app could just be set to launch on boot, causing it to run on the next power cycle. But even easier, couldn't an app just have a receiver for a very common function (such as turning the screen on), thus running itself without the user being aware?

Is it even possible for an app to act as a receiver to an alarm timer so that it automatically gets run every minute?

Many people run App Ops right after installing an app to limit exposure. But it seems like it would be almost trivial for an app to run code immediately after being installed.

Is this correct, or are there safeguards to prevent this?

Answer 1

Take a look at Broadcast Actions (scroll down to Standard Broadcast Actions).

All intents that are declared as a Broadcast Action can be received by an app that declared a receiver in its manifest.

There are some broadcasts that require explicit registering in the system (Annotated with You can not receive this through components declared in manifests, only by explicitly registering for it with Context.registerReceiver().).

The most important ones for apps that run code after installing are:

• ACTION_USER_PRESENT: Sent when the user is present after device wakes up (e.g when the keyguard is gone).
• ACTION_SCREEN_ON: Broadcast Action: Sent when the device wakes up and becomes interactive.
• ACTION_SCREEN_OFF: Broadcast Action: Sent when the device goes to sleep and becomes non-interactive.
• ACTION_MY_PACKAGE_REPLACED: A new version of your application has been installed over an existing one. This is only sent to the application that was replaced. It does not contain any additional data; to receive it, just use an intent filter for this action.
• ACTION_HEADSET_PLUG: Wired Headset plugged in or unplugged. Same as ACTION_HEADSET_PLUG, to be consulted for value and documentation.
• ACTION_DATE_CHANGED: The date has changed.

(Source: http://developer.android.com/reference/android/content/Intent.html)

Is it even possible for an app to act as a receiver to an alarm timer so that it automatically gets run every minute?

Yes it is possible using the ACTION_TIME_TICK Broadcast Action. It has to be registered using Context.registerReceiver() but after that the registered service is called every minute.

Many people run App Ops right after installing an app to limit exposure. But it seems like it would be almost trivial for an app to run code immediately after being installed.

Is this correct, or are there safeguards to prevent this?

Your assumption is quite correct. Theoretically any app could declare a Broadcast Receiver to receive one of the above mentioned Broadcast Actions and start executing some code. This is even more crucial when updating an app because of the ACTION_MY_PACKAGE_REPLACED broadcast to execute code right after the update is completed. That's the reason many people use AppOps to prevent apps from running if one of the more often sent broadcasts are sent.