12

I have an app that requires no permissions whatsoever. Please note that this app does not come from an official source.

Given that the app requires no permissions:

  1. Can I be completely sure that it is safe to install?
  2. Are there still ways in which this app might be harmful or malicious to my device, even though it does not have any permissions?
Improve this question

1 Answer 1

Reset to default
10
+150

In an ideal world, an Android app that has no permissions would mean that the app can not seriously harm your device.

Unluckily we are not living in an ideal world, especially on Android where the device manufacturer often does not provide the newest security updates to each and every device.

Therefore running a malicious app without any permission on an Android device can end up in a permanent device infection if the device is vulnerable to an exploit that allows the app to get root permissions. Those exploits can work independently if your device is rooted or not, then work even on stock rom devices.

Therefore the risk executing an app without any permission depends on large parts if your device has the very latest security update (see patch level date in Settings -> System -> About -> Security patch level).

If your device has the most recent patch level and the app is not brand new the risk is low that the app is able to harm your device. However if your device has a security patch level months or even years ago even an app without permissions may cause serious harm to your device.

What is possible on different Android versions

There is an old article (2012) on AndroidPolicy: Security scare of the week: What can an app with no permissions do? which lists a few facts about what apps can do without any permissions. Lets try to check some of the facts and check them regarding modern Android devices:

Read data on your SD card

By default on devices prior to Android 4.4 apps had by default read access to the sd-card section:

This permission is enforced starting in API level 19 (Android 4.4). Before API level 19, this permission is not enforced and all apps still have access to read from external storage. You can test your app with the permission enforced by enabling Protect USB storage under Developer options in the Settings app on a device running Android 4.1 or higher. [source]

But even on newer versions there is still the possibility to get sd-card access "for free" in case the app defines that it was developed for some very old Android version. In such a case Android implicitly grants the sd-card read permission (untested: is this still true for e.g. an Android 10 device?)

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 (Android 1.5) or lower, the system implicitly grants your app this permission.

To avoid misuse of those "implicit permissions" Google enforces a certain targetSdkVersion when uploading an app to Google PlayStore [source]. Hence if you have an app from Google PlayStore that has been published in 2018 or later (latest update) those implicit permissions on the sd-card are impossible.

Read installed apps via /data/system/packages.list

-> TBD

Miscellaneous data from /proc

Android ID, kernel version, and ROM version

-> TBD

Improve this answer
5
  • 3
    +1. Do you know if an app which doesn't require a permission can cause the default browser to launch a spammy link which may be containing a malware?
    – Firelord ♦
    Commented Mar 3, 2019 at 14:16
  • 2
    @Firelord Yes that works, just verified. Therefore you could also use it for sending data URL encoded to any server you want (if a default browser is set).
    – Robert
    Commented Mar 3, 2019 at 14:31
  • 1
    Hey Robert. Do you think you can find time to take a look at this article and see if any of the issues still exist with recent version of Android? I don't think the article is of much use, but incorporating anything of importance from there into your answer would be good IMO. :)
    – Firelord ♦
    Commented Apr 30, 2020 at 4:59
  • @Firelord I have updated my answer with the claims from the article and some details I knew on the sd-card topic. The other claims I am not very familiar with. May be someone other can provide this info.
    – Robert
    Commented Apr 30, 2020 at 9:23
  • Thanks. I tried to do some testing but couldn't find a suitable app. And the results I got from Terminal Emulator app are something I'm not sure I can use (because OP said no permissions app, but TE does asks some permissions) here. Nevertheless, I could list the kernel version /proc/version, ROM version, execute getprop and get rich details, cpuinfo (/proc/cpuinfo), but /data/system/packages.list was not accessible even though /data/system directory items could be listed.
    – Firelord ♦
    Commented Apr 30, 2020 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .