Recently I noticed I have opera browser installed. I definitely did not install it because I was sleeping at that time. I checked installation time and revealed it was the day before yesterday
Checking installation source like this outputs android
:
adb shell dumpsys package com.opera.browser | grep -e "installerPackageName"
so I don't know whether it was through Play Store or through APK.
Can I found out who have done this and how can I prevent future intrusions?
P.S. I have MIUI 11.0.3 Global device
UPDATE:
INSTALL_PACKAGES permission
apps
- com.miui.msa.global
- com.android.vending
- com.miui.cloudbackup
- com.google.android.packageinstaller
- com.xiaomi.mipicks
- com.android.managedprovisioning
- com.facebook.system
- com.miui.analytics
- com.xiaomi.discover
users
- android.uid.backup
- android.uid.shell
services
- com.lbe.security.miui/com.lbe.security.service.SecurityService
REQUEST_INSTALL_PACKAGES permission
- android
- com.miui.msa.global
- com.android.browser
- com.miui.player
- com.google.android.gm
- com.google.android.apps.docs
- com.android.chrome
- com.xiaomi.midrop
- com.miui.hybrid
- com.miui.securityadd
users
- android.uid.bluetooth
adb logcat
ASAP (might be too late for this case, as the buffer is certainly already overwritten after two days) andgrep
that for evidence. For potential culprits, check which apps have the permission to install other apps (INSTALL_PACKAGES
) – though AFAIK only system apps should be granted that. Logcat still is the best approach, if you catch such an issue in time.check which apps have the permission to install other apps (INSTALL_PACKAGES)
how to do this system-wide? or the only way is one-by-one approach?adb shell dumpsys package | grep INSTALL_PACKAGES
would come to mind. Or just taking the output ofdumpsys package
and use some editor/viewer to look for that string (might be easier to get the context that way). Of course you could also "automate" that by something likefor app in $(adb shell pm list packages |awk -F: '{print $NF}'); do adb shell dumpsys package $app | grep INSTALL_PACKAGES; done
, which then should give you a list of package+perm.