Monitor activites of an app and see what it is sending over the internet

Question

Few months ago, I installed an automation app called MacroDroid, but after few days I uninstalled it. Now today, when I was checking apps in /system/app I stumbled upon an app called MacroDroidSystemHelper (com.arlosoft.macrodroid.helper)

I had granted the MacroDroid superuser access when I was using it so it may have made the app that I found today a system app.

I tried to launch it but it doesn't have an interface.

While checking its permission I came to know that it has the connectivity permission, hence, I have to find out what data it is sending to internet. How can I monitor its activities?

_{(Click image to enlarge)}

Answer 1

It appears that MacroDroid now (I've v3.10.1) doesn't go with the approach of installing helper file inside /system as default option. Instead, it now uses it as a backup approach and only when you're having an issue with GPS/NFC. If you've that file inside /system then either it was installed when you were using a version older than v3.10.1 or you deliberately chose to fall back to older technique via its settings.

The latest version of that helper file is 1.2 and following are the permissions mentioned in its manifest:

• android.permission.WRITE_SETTINGS - Allows an application to read or write the system settings.
• android.permission.WRITE_SECURE_SETTINGS - Allows an application to read or write the secure system settings. Not for use by third-party applications.
• android.permission.NFC - Allows applications to perform I/O operations over NFC.

In order to connect to network, it must ask the permission android.permission.INTERNET - not present in the manifest. So you can be rest assured that the app, on its own, won't be able to send any data.

That said, given the nature of the title, you don't need to monitor activities of an app (no benefits) if your goal is to find out what data it is accessing or is sending. You can use XPrivacy in this case. It requires Xposed Framework. XPrivacy can notify you when the app tries to access a privacy sensitive permission. That would give a rough estimation of the extent of data app may be accessing. You can use a firewall to restrict app's access to internet and get notified whenever the app tries to access network.

Still, in order to see the data the app is sending, you would have to capture it or sniff it at least. Answers for Capturing mobile phone traffic on wireshark and Monitor network activity in Android Phones may prove to be helpful. (I've not tried any of the solutions there.)