1

Recently I noticed I have opera browser installed. I definitely did not install it because I was sleeping at that time. I checked installation time and revealed it was the day before yesterday

enter image description here

Checking installation source like this outputs android:

adb shell dumpsys package com.opera.browser | grep -e "installerPackageName"

so I don't know whether it was through Play Store or through APK.

Can I found out who have done this and how can I prevent future intrusions?

P.S. I have MIUI 11.0.3 Global device

UPDATE:

INSTALL_PACKAGES permission

apps

  • com.miui.msa.global
  • com.android.vending
  • com.miui.cloudbackup
  • com.google.android.packageinstaller
  • com.xiaomi.mipicks
  • com.android.managedprovisioning
  • com.facebook.system
  • com.miui.analytics
  • com.xiaomi.discover

users

  • android.uid.backup
  • android.uid.shell

services

  • com.lbe.security.miui/com.lbe.security.service.SecurityService

REQUEST_INSTALL_PACKAGES permission

  • android
  • com.miui.msa.global
  • com.android.browser
  • com.miui.player
  • com.google.android.gm
  • com.google.android.apps.docs
  • com.android.chrome
  • com.xiaomi.midrop
  • com.miui.hybrid
  • com.miui.securityadd

users

  • android.uid.bluetooth
Improve this question
9
  • 1
    AFAIK playstore always sets the installer, so I rather suspect a different source. I'd copy adb logcat ASAP (might be too late for this case, as the buffer is certainly already overwritten after two days) and grep that for evidence. For potential culprits, check which apps have the permission to install other apps (INSTALL_PACKAGES) – though AFAIK only system apps should be granted that. Logcat still is the best approach, if you catch such an issue in time. – Izzy♦ Jan 27 '20 at 22:47
  • check which apps have the permission to install other apps (INSTALL_PACKAGES) how to do this system-wide? or the only way is one-by-one approach? – Suncatcher Jan 28 '20 at 6:51
  • 1
    adb shell dumpsys package | grep INSTALL_PACKAGES would come to mind. Or just taking the output of dumpsys package and use some editor/viewer to look for that string (might be easier to get the context that way). Of course you could also "automate" that by something like for app in $(adb shell pm list packages |awk -F: '{print $NF}'); do adb shell dumpsys package $app | grep INSTALL_PACKAGES; done, which then should give you a list of package+perm. – Izzy♦ Jan 28 '20 at 7:49
  • unfortunately logcat was overwritten already. Is there any way to increase logcat persistence period? – Suncatcher Jan 28 '20 at 19:49
  • 1
    Sorry, I currently lack the time to dig into that. There are some apps capable of "collecting" the logcat, keeping a "full copy" e.g. on the SD card for later investigation (see here and watch e.g. for "Syslog") – so once you notice such an app popping up, you can grep that collection for details; installation should appear there, too. That's the approach I'd try. – Izzy♦ Jan 31 '20 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.