On Twitter November 25, 2013 update, they ask for receive text messages (SMS) permission. Does anyone know what exactly this is for ?


I was concerned about this as well and decided to decompile the app to find out what it's doing. Twitter receives SMS messages via a BroadcastReceiver in com.twitter.applib.client.SmsReceiver. Here is what the code looks like after decompiling it to Java with dex2jar and jd-gui.

public class SmsReceiver extends BroadcastReceiver
  private void a(Context paramContext, SmsMessage paramSmsMessage)
    if (paramSmsMessage != null)
      String str1 = paramSmsMessage.getMessageBody();
      String str2 = paramContext.getText(mb.sms_verification_text).toString();
      if (("40404".equals(paramSmsMessage.getOriginatingAddress())) && (str1.startsWith(str2)))
        SharedPreferences localSharedPreferences = PreferenceManager.getDefaultSharedPreferences(paramContext);
        localSharedPreferences.edit().putString("device_registration_sms_text", str1).commit();
        String str3 = localSharedPreferences.getString("device_registration_normalized_phone_number", "");
        if ((!TextUtils.isEmpty(str3)) && (!TextUtils.isEmpty(str1)))
          a.a(paramContext).c(str3, str1);

  public void onReceive(Context paramContext, Intent paramIntent)
    Bundle localBundle = paramIntent.getExtras();
    if (localBundle != null)
      Object[] arrayOfObject = (Object[])localBundle.get("pdus");
      int i = arrayOfObject.length;
      for (int j = 0; j < i; j++)
        a(paramContext, SmsMessage.createFromPdu((byte[])arrayOfObject[j]));

You see see here that when a text message is received, the app passes the message to a() and checks that it comes from twitter's number. Then it writes the content of the message to shared preferences. As Problematic suggested, the app is only verifying your number and not doing anything malicious. Although Twitter isn't doing anything malicious, it would have been nice if they would have explained why the app needs this permission in the last update.

  • 'it would have been nice if they would have explained why the app needs this permission in the last update' +1 – Bishan Nov 27 '13 at 3:32
  • Now they have ReceiveSMS permission. currently they scan for only SMS received from twitter. but in the future they can read any SMS without asking for any permission. :( – Bishan Nov 27 '13 at 3:35
  • Yup. I don't think Twitter would abuse this permission, but that does underscore a problem with the permission system. Fortunately it's usually not too hard to reverse Android apps and find out what they are really doing, and major vendors would likely be caught doing something malicious in an update. – bitwize Nov 27 '13 at 18:46
  • If developers obfuscates codes, it's hard to reverse engineer. – Bishan Nov 28 '13 at 3:15
  • Statically analyzing is harder but you can still hook method calls at runtime or MitM the traffic (this is usually not that hard even if there is certificate pinning) to see what information is being processed and what data is being sent to and received from servers. – bitwize Nov 28 '13 at 21:12

An app like Permissions can tell you the meaning of the different types of permissions.

For receive text messages (SMS):

Allows the app to receive and process SMS messages. This means the app could monitor or delete messages sent to your device without showing them to you.

  • 1
    I think the OP wants to know why the Twitter app in particular wants to do this. – Dan Hulme Nov 26 '13 at 10:57

As far as I have been able to tell, there is no official information on what this permission is for.

I have seen this in another app in the last little while. The Google Hangouts app recently gained the SMS permission and uses it (in addition to displaying your phone's SMS messages in the app) to process phone number confirmation texts: the Hangouts app processes the SMS message and verifies your number without requiring you to enter the code (or even showing you the SMS message). If I had to make an educated guess, I would assume the Twitter app is doing something similar, but again, there is no official word on the purpose of this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.