9

Normally, if I have to install an apk(say from SD card), I need to enable “Unknown Sources” in my phone's settings. But when I transfer and install any APK from another phone using "ShareIt", no such permission is required by my phone.

How is ShareIt able to bypass this permission?

  • Did ShareIt come pre-installed on your device, or did you install it yourself? – Izzy May 10 '17 at 16:15
8

I did a bit of digging and it is possible without System permissions from API 21 onwards https://developer.android.com/reference/android/content/pm/PackageInstaller.html.

In fact, there is a code sample by Google which shows how to do it. https://github.com/googlesamples/android-testdpc/blob/master/app/src/main/java/com/afwsamples/testdpc/cosu/CosuUtils.java

  • Kudos for digging this up, now to find whether the app actually used this... – Andy Yan Apr 1 '17 at 8:01
  • 2
    @beeshyams - Not really. The app cannot do a "silent" install. Through the pending intent, the user's explicit "click" is required at the time of installation. – Neo Apr 1 '17 at 8:13
  • 1
    @Neo Damn, so I just assumed a silent install when I wrote my answer... My bad. – Andy Yan Apr 1 '17 at 8:16
  • 2
    In other news, the package of ShareIt seems to be somehow obfuscated, so even though my tools succeeded in the Java code generation, nothing significant can be seen from the stubs. – Andy Yan Apr 1 '17 at 8:19
  • Wait - I used another tool, and I think I might've got it. I'll have it edited into your answer after verification. – Andy Yan Apr 1 '17 at 8:33
4

If the apps are installed silently (i.e.without the usual installation dialog), presumably these apps directly call pm, i.e. PackageManager, which as a system app bears the permission android.permission.INSTALL_PACKAGES.

The phone has to be rooted so the app could call pm in a root context, else you will be greeted with the message "Neither user xxxx nor current process has android.permission.INSTALL_PACKAGES".

EDIT: As @Izzy pointed out in the comment, android.permission.INSTALL_PACKAGES is also granted to apps installed to /system. See below comment and this SO question for more insight.

  • Note that I didn't actually try ShareIt and analyse what it really does, just putting forward the most likely theory. If you are not rooted and it still worked, then we might have a much more interesting problem to look into. – Andy Yan Apr 1 '17 at 6:28
  • 1
    @beeshyams In China here, a lot of 3rd party app markets would do silent or automated install. The 1st way is as described here, and they will ask for root permission on first install; the 2nd is to ask you to turn on an accessibility service, then automate the clicks on the "install" buttons. – Andy Yan Apr 1 '17 at 6:57
  • 1
    My phone is not rooted. And it did not ask for root permissions either. But in India, ShareIt is a very popular method of installing apps through peer-to-peer. – Neo Apr 1 '17 at 7:21
  • 1
    @beeshyams Avoid that app and its horrendous mole of required permissions. Consider using the open source Share via HTTP (available on F-Droid), instead. I'm in no way affiliated with the app. – Death Mask Salesman Apr 1 '17 at 17:30
  • 1
    @beeshyams It works with any device connected to the same network. As far as I can tell, the host must be Android, but any device can then connect to the same network and visit the HTTP address shown in the app to download the file(s). – Death Mask Salesman Apr 1 '17 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.