0

I want to know if a system-app is able to read the data of other apps (the data stored in /data/data.) on Android 9.

Thanks!

2

Yes! System Apps with the protection level signature (the System APK must be signed with the same key used to sign the ROM/Firmware), can read/write/execute/delete all data stored on /data/data or other folders on the device.

Note that third party apps (OEM custom apps) found on system/priv-app with protection level signatureOrSystem (Deprecated in Android 6.0). may not be able to do this unless they have signature protection level which means signed with the same key as the ROM/Firmware.

Examples: I've seen some chinese manufactures with their built-in data clone solutions which can make a backup to the whole APK and it's data in another phone, and IMO, this is a security risk which should not exist at all on android devices.

EDIT 1: As i've mentioned before let's take a look at an Android APK which is able to copy other APKs data/data folders, it's called Amiclone "com.gionee.dataghost" from the Chinese smartphone manufacturer Gionee (which BTW, faced bankruptcy and liquidation on 2018)

  • We have the following information, from version 2.1.0w_pub build 20100022

    • Permissions:

      android.permission.ACCESS_COARSE_LOCATION
      android.permission.ACCESS_MTK_MMHW
      android.permission.ACCESS_NETWORK_STATE
      android.permission.ACCESS_SUPERUSER
      android.permission.ACCESS_WIFI_STATE            
      android.permission.BLUETOOTH
      android.permission.BLUETOOTH_ADMIN
      android.permission.CHANGE_NETWORK_STATE
      android.permission.CHANGE_WIFI_STATE
      android.permission.GET_TASKS
      android.permission.INSTALL_PACKAGES
      android.permission.INTERNET
      android.permission.KILL_BACKGROUND_PROCESSES
      android.permission.MANAGE_DOCUMENTS
      android.permission.MODIFY_PHONE_STATE
      android.permission.MOUNT_FORMAT_FILESYSTEMS
      android.permission.MOUNT_UNMOUNT_FILESYSTEMS
      android.permission.READ_CALENDAR
      android.permission.READ_CALL_LOG
      android.permission.READ_CONTACTS
      android.permission.READ_EXTERNAL_STORAGE
      android.permission.READ_LOGS
      android.permission.READ_PHONE_STATE
      android.permission.READ_SMS
      android.permission.RECEIVE_BOOT_COMPLETED
      android.permission.RECORD_AUDIO
      android.permission.UPDATE_APP_OPS_STATS
      android.permission.WAKE_LOCK
      android.permission.WRITE_CALENDAR
      android.permission.WRITE_CALL_LOG
      android.permission.WRITE_CONTACTS
      android.permission.WRITE_EXTERNAL_STORAGE
      android.permission.WRITE_MEDIA_STORAGE
      android.permission.WRITE_SECURE_SETTINGS
      android.permission.WRITE_SETTINGS
      android.permission.WRITE_SMS
      com.gionee.youju.statistics.permission.READ_PROVIDER
      com.gionee.youju.statistics.permission.WRITE_PROVIDER
      
    • Signature:

      Number of signers: 1
      Signer #1 certificate DN: EMAILADDRESS=gionee@gionee.com, CN=Gionee, OU=Gionee, O=Gionee, L=ShenZhen, ST=GuangDong, C=CN
      Signer #1 certificate SHA-256 digest: c2d992c8a4cda2eed55f69357d6759937878e9a0f0b629524e88aa81ed65f802
      Signer #1 certificate SHA-1 digest: 1bb8b4f46eafc2a06a46ba68fd8de543a5c65cbd
      Signer #1 certificate MD5 digest: b49792a5687b641492e10a29152f7454
      Signer #1 key algorithm: RSA
      Signer #1 key size (bits): 2048
      Signer #1 public key SHA-256 digest: 858b75200e11e0e62f6377b0b56beb728085823bddc31669d8348ee28b651815
      Signer #1 public key SHA-1 digest: c780dfb20637a7cedcaf78298ec1bfcb7b069da1
      Signer #1 public key MD5 digest: ceb817433cbe5a6a3c42cc7a562617ab
      

Also, this APK has a built-in busybox binary, and it's able to dump the whole user data from /data/data folders while transferring Apps from a Gionee device t o another.

Conclusion:

Yes, a system APK can copy other Apps and their data, but it's not only about signature as @Irfan has pointed out in his comment, there are permissions of different levels (some of them require signature level protection) etc... But, as Android Enthusiasts replies are generally for end-users, the full details are not required to answer a question.

|improve this answer|||||
  • No they can't. It's not only about signatures. – Irfan Latif Nov 25 '19 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.