How exactly do android permissions work?

[LJ Sal]

People say app permissions can access your camera, microphone, photos, SMS, Ect..without your knowledge. Does that mean that the developer of the app can access that on anyone's phone if they are a user on the app? For example let's say a third party app that's cracked or modded scanned with no malware that has the app permissions on your phone, can they access a user who downloads their app phone features anytime and view their gallery, SMS, take pictures and hear through their microphone?

 

[methodman89]

If you have a bad actor who sneaks it into the playstore, then everything you mention can be done. If you Google it, you will see that it has been done and discovered, but too late for the people who dl the apps that were malicious. It's fairly certain that there are more to be discovered.

 

[chanchan05]

App permissions allow the app to use certain aspects of the phone. For example, if an app has camera permissions, then it can use the camera.

As for your question, potentially yes, if the developer coded for that. An app can use the camera without your knowledge to take pictures IF the developer was a crook and hid that code in the app. It's up to you if you would trust the developer not to do that. Are they actually doing it? If the app was downloaded from a legitimate source, not likeky. Google does do regular inspections of the apps in the app store and removes apps that violate these stuff. They are also able to send commands to your phones through the play store app to remove the app that was found to be malware.

But the app having those permissions does not mean it does that. It just means that it has the potential to do that. But there are also certain combinations of permissions that need for this to happen. For example an app with camera permissions but no permission for interner access, this is no danger. Because even if it can use the camera without your knowledge, it has no permission to use internet to send those pictures it took anywhere.

Other apps are made actually to do that for specific purposes. For example a security app like Cerberus was specifically designed to take a picture with the front camera and send and email with that picture if someone entered the wrong passcode on your phone, and this is designed to happen without the person entering the wrong code that it happened.

Basically, don't get anything outside of legitimate sources and you should be relatively safe.

But that does not mean it doesn't happen.

 

[LJ Sal]

Thank you I understand it a lot better. So are you saying it is illegal for a app developer to steal your sms, use your camera and steal your photos, ect even if the permissions is on? or for the app developer to do so the app has to be malicious? what if you download a app from a unknown source that is not from Playstore and contains no malware, can the developer access your stuff that permissions are on or not since the app detects or has no malware?

 

[chanchan05]

Thank you I understand it a lot better. So are you saying it is illegal for a app developer to steal your sms, use your camera and steal your photos, ect even if the permissions is on? or for the app developer to do so the app has to be malicious? what if you download a app from a unknown source that is not from Playstore and contains no malware, can the developer access your stuff that permissions are on or not since the app detects or has no malware?

Malware scans are ineffective really. They just scan if the app or certain components or known behavior of the app if they are possible malware.

The developer can hide the content stealing in the code of the apps. As far as I know malware scanners don't actually scan the entire code.

Basically if the app is not from a legitimate source, then there is a high possibility that the developer altered it to steal data from you. Regardless of whether your malware scan reads it or not.

 

[LJ Sal]

Oh okay and one last thing, some app permissions include the "access anytime without your knowledge" but other app permissions don't. For example on my it always say something an access my camera without knowledge but doesn't say that n storage, read contents on your sd card, write ro sd card or modify. Why does it not include other permissions can be accessed with your knowledge? indicating that can't right?