59
votes

Suppose I want to run some program which requests too many permissions. For example, record from the microphone or read IMEI of my phone. However, there are no practical explanation why recording from the mic or IMEI number is needed for this particular application, except for data mining.

I want to try this app, but restrict its permissions. For example, if it reads IMEI, it should get random IMEI (but the same every time). If it tries to read the mic, it should get silence.

Some other interesting permissions:

  1. Phonebook read/write access - returns zero contacts, pretend that write is OK, but actually do nothing.
  2. Send SMS - pretend that SMS is sent, but do nothing.
  3. Get list of visible Wi-Fi networks - return zero networks.

Obviously the tool should require a rooted phone. Are there any such tools?

3
  • 1
    Could you use the emulator in the developer SDK to accomplish a lot of this?
    – ale
    Dec 2 '10 at 15:09
  • 5
    Basically, yes. Using emulator as a sandbox is possible. But what if I want to run an app on the physical phone, but keep my privacy? Dec 2 '10 at 15:35
  • I know this question is old, but can you elaborate what context make you you want to test some malicious app on your own personal physical device and answer bogus personal data ? To me, current cyanogenmod solution (reject calls, do not produce fake data) seems enough. Aug 21 '14 at 18:29
14
votes

XPrivacyLua is a module for Xposed framework which does exactly what you need. It is free and open source. Works on rooted devices. It's the successor of XPrivacy.

Install Xposed from here: https://forum.xda-developers.com/showthread.php?t=3034811

You can then download the XPrivacyLua module from the Xposed repo through the Xposed Manager app, or manually from here:

https://repo.xposed.info/module/eu.faircode.xlua

Source:

https://github.com/M66B/XPrivacyLua


If you're running Android 5 or lower, you can use the legacy XPrivacy module.

1
  • Very good tool. Exactly what I was craving for. Jan 8 '15 at 15:07
4
votes

MockDroid is another academic firmware with data faking capabilities.

3
votes

It's a logical solution for a potential problem and a long time irritation of mine.

However, you must remember that whatever solutions are available for a security application would also be available for a malware app. If a security app could block net access then a malware app could block it also, stopping a security app from updating data files for instance.

It needs to be done at the system level, not as another application.

See my post here for my thoughts.

1
  • 4
    Such tools would require root access to the phone, if you grant it, should have an ultimate trust in the tool, like "Permissions Denied". If you grant root access to a random application from the market, you just shot yourself in the foot :) Aug 3 '11 at 3:16
3
votes

A translated version of the Chinese version of LBE is available on XDA developers, and it works very well on Jelly Bean. Apparently the Chinese version is still actively developed.

http://forum.xda-developers.com/showthread.php?t=1422479

2
votes

There is an ongoing research on this this subject. A non yet released proof of concept is implemented for some of the privacy sensitive APIs exactly as I proposed. The privacy manager is called TISSA, short for Taming Information-Stealing Smartphone Applications.

1
vote

Marshmallow (Android 6) has a new permissions model. Applications targeting Marshmallow can now be restricted to fewer permissions at runtime, and these applications should fail gracefully, rather than the all-or-nothing permissions model of prior Android versions. In Marshmallow, this is a feature of the standard OS, and does not require rooting or additional applications.

1
  • 1
    Hi mattm! It would be good if you go in-depth here. For example, the new permission model doesn't give any control on internet permissions. If possible, use screenshots for a more better way to make us understand what you're talking about.
    – Firelord
    Oct 31 '15 at 8:24
0
votes

https://island.oasisfeng.com/

Island does most if not all of this...

1
  • Welcome to Android Enthusiasts! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Mar 27 at 19:55
-1
votes

I'm fairly certain that tool that you seek doesn't exist yet. But your idea is great. Few point though;

ofc; app can freely read and write it's own app directory

giving fake read acces : for every possible read (and there's a lot app can try to read) default response should be generate; lot a work but doable

however; giving fake write access is lot harder; what if it uses sd card to store big temp files; like bitmaps. On unrooted phone; only place app can write is sd card; and using content provider (for stuff like contacts, and calendar). And app desiger isn't expecting to fail in writing data; so app could crash.

Good thing is that the worst that could happen is that app might crash.

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.