Android Permissions and Malware

Question

Can an Android Malware App "hide" certain important permissions thereby fooling the user to be "good" (or intended to do only what its posed purpose is). Thus can the user "believe" the App to be genuine and install it? In short is there anyway an App can fake its permissions? I know that there is an AndroidManifest.xml which every developer of App must customize in order to get the necessary permission. And most certainly this is what gets displayed to the user so that he/she can acknowledge before he/she installs the App. Now my question is, is there a way the user is not "shown" any of the permissions??

Answer 1

No. At least not without bugusing. All permissions not written into the manifest, will not be granted to the app by android. Since Android 6 an app can also request permissions at runtime. Then they are not in the manifest and the user does not grant them when installing but as soon as the app requests those permission, the user will have to grant them.

In short: you have control over the permissions and there is no easy way to bypass this system.

There is however the possibility to use other apps to bypass the permission handling. E.g. if your app does include a chrome browser window, it's not necessary for your app to have the internet access permission since chrome already has that permission.

Answer 2

To my knowledge: Not directly. But with the current permission policy on Google's end, it can still fool you:

The usual approach here is to first publish a "clean app" that requests only basic permissions – but takes care to cover all "permission groups" it later needs (see: Android Permission Groups). So it could e.g. ask for the INTERNET permission (which is even automatically granted, and requested by about 80% of all apps, thus being unsuspicious), which belongs to the NETWORK group. Lateron, the developer will publish an update, which then additionally asks for e.g. the permissions to CHANGE_NETWORK_STATE, CHANGE_WIFI_STATE, and DOWNLOAD_WITHOUT_NOTIFICATION – which also belong to the NETWORK group.¹ As the installed app already has one permission of this group, the user will NOT be made aware of these new permissions (the install dialog of Google Play Store will show "This app requires no significant new permissions"), thus considering the app "safe". But with those new permissions, the app is now able to establish connections to networks of its choice at the time of its choice, and downloading "stuff" – without the user having to do anything.

Of course one could always check the full permission list before each update. But 1) the corresponding link is not really obvious (you had to scroll to the very end of the app's playstore page to see it), 2) that would mean you remember which permissions the installed version already has, and 3) this is a tedious job at least when it comes to 10 permissions and more (not a rare case: about 25%+ of all apps require 10 permissions or more). Apart from that, 4) if "auto-update" is turned on in the Google Play Store app (which is the default), those updates would be installed without the user having a chance to verify before.

So this is not even possible, but Google makes this scenario even very easy for the "bad guys" to use. It was not always this way: until mid-2013, on updates each added permission was brought to the attention of the user. This new system was rolled out to "improve the user experience" and "make the Playstore more user-friendly". Despite of critics with security concerns, it was kept that way.

---

^1: _{This is just an example constellation. Consider other Permission groups and their permissions as well – e.g. BLUETOOTH and BLUETOOTH_ADMIN.}