I've noticed quite a few apps requesting the
RECEIVE_SMS permission. Two things are clear to me here:
RECEIVE_SMSenables an app to "snap" incoming SMS
READ_SMSjust applies to SMS already stored
As some of the apps just were asking for
RECEIVE_SMS, but not for
READ_SMS, I got curious: this seems to imply
RECEIVE_SMS is not only targeted at the receiving part, but the app can also do what it wants with the received message – e.g. read it, then throw it away silently (so the user doesn't even notice there was an SMS – which might be the way TAN Trojans act to snap identifiers for online banking transactions).
But would it also be possible for such an app to "intercept" the message, i.e. receive it, read it (and process its content in any way, e.g. forwarding it by other means such as via IP), and then pass it on as if nothing had happened? In other words: Can it spy on the user this way?