US-based security firm Lookout revealed the results of its ‘App Genome Project’ report, demonstrating that around 300,000 applications for both Apple’s iPhone and Google’s Android operating systems, were stealing user data. But if you are an Android user, here are some useful tips to stay safe and secure your data from these malicious apps.
Android Apps Permissions Explained
When you install an application from the Android Market, it will tell you all of the permissions it needs to function. These are important to read as it can give you an idea if the application is asking for permission to do more than it needs. While some legitimate apps often ask for more permission than they need, it should at least raise an eyebrow when deciding if an application is safe and of good quality. Again, to see the permission given to an application after installation, go to the Market, press menu > downloads, then select the app, press menu again, then press security.
This list was initially prepared by alostpacket who talks about android security in greater detail. The list is not definitive by any means and will be updated as and when it is needed.
Services that cost you money – make phone calls This permission is of moderate to high importance. This could let an application call a 1-900 number and charge you money. However this is not as common of a way to cheat people in today’s world. Legitimate applications that use this include: Google voice and… (suggestions needed here).
Services that cost you money – send SMS or MMS This permission is of moderate to high importance. This could let an application send an SMS on your behalf, and much like the phone call feature above, it could cost you money. Certain SMS numbers work much like 1-900 numbers and automatically charge your phone company money when you send them an SMS.
Storage – modify/delete SD card contents This permission is of high importance. This will allow the applications to read, write, and delete anything stored on your phone’s SD card. This includes, pictures, videos, mp3s, and even data written to your SD card by other applications. However there are many legitimate uses for this permission. Many people want their applications to store data on the SD card, and any application that stores information on the SD card will need this permission. You will have to use your own judgment and be cautious with this permission knowing it is very powerful but very often used by legitimate applications. Applications that typically need this permission include (but are not limited to): camera applications, video applications, note taking apps, backup applications.
Your personal information – read contact data This permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn’t much of a reason to give an application this permission. The one exception to that rule includes typing or note taking applications and/or quick-dial type applications. Those might require your contact information to help make suggestions to you as you type. Typical application that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.
Your personal information – read calendar data, write calendar data This permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access.
Phone calls – read phone state and identity This permission is of moderate to high importance. Unfortunately this permission seems to be a bit of a mixed bag. While it’s perfectly normal for an application to want to know if you are on the phone or getting a call, this permission also gives an application access to 3 unique numbers that can identify your phone. The numbers are the IMEI, IMSI and a 64 bit unique id that Google provides for your phone. Some software developers use this as a means of tracking piracy. Additionally, any developer targeting older versions of android (1.6 and earlier I believe) will get this permission automatically added to their app. Nevertheless, while this permission can be innocuous, it is one to keep a good watch on. As someone posted in this thread the application Locale was caught sending this information over the internet unencrypted to a third party — much to to the surprise of it’s users.
Your location – fine (GPS) location While not a danger for stealing any of your personal information, this will allow an application to track where you are. Typical applications that might need this include (but are not limited to) restaurant directories, movie theater finders, and mapping applications.
Your location – coarse (network-based) location This setting is almost identical to the above GPS location permission, except that it is less precise when tracking your location.
Network Communication – create Bluetooth connection Bluetooth is a technology that lets your phone communicate wirelessly over short distances. It is similar to Wi-fi in many ways. It itself is not a danger to your phone, but it does enable a way for an application to send and receive data from other devices.
Network Communication – full internet access This is probably the most important permission you will want to pay attention to. Many apps will request this but not all need it. For any malware to truly be effective it needs a means by which to transfer data off of your phone, this is one of the setting it would definitely have to ask for. However, in this day and age of cloud computing and always-on internet connectivity, many, many legitimate applications also request this. You will have to be very careful with this setting and use your judgment. It should always peak your interest to think about whether your application needs this permission. Typical applications that would use this include but are not limited to: web browsers, social networking applications, internet radio, cloud computing applications, weather widgets, and many, many more.
Network communication – view network state, view Wi-Fi state This permission is of low importance as it will only allow an application to tell if you are connected to the internet via 3G or Wi-Fi.
System tools – Prevent phone from sleeping This is almost always harmless. An application sometimes expects the user to not interact with the phone directly sometimes, and as such would need to keep the phone from going to sleep so that the user can still use the application. Many applications will often request this permission. Typical applications that use this are: Video players, e-readers, alarm clock ‘dock’ views and many more.
System tools – Modify global system settings This permission is pretty important but only has the possibility of moderate impact. Global settings are pretty much anything you would find under Android’s main ‘settings’ window. However there are a lot of these setting that are perfectly reasonable for an application to want to change. Typical applications that would use this include: Volume control widget, notifications, widgets, settings widgets.
System tools – read sync settings This permission is of low impact. It merely allows the application to know if you have background data sync (such as for Facebook or Gmail) turned on or off.
System tools – Write Access Point name settings I need a bit of clarification on this setting myself. I believe this relates to turning on and off wifi and your 3G data network. (if someone can comment and clarify I would greatly appreciate it and update this guide to reflect). Essentially however I believe this to be similar to the ‘modify global settings’ permission above.
System tools – automatically start at boot This permission is of low to moderate impact. It will allow an application to tell Android to run the application every time you start your phone. While not a danger in an of itself, it can point to an applications intent.
System tools – restart other applications This permission is of low to moderate impact. It will allow an application to tell Android to ‘kill’ the process of another application. However that application should have the option of immediately restarting itself.
System tools – retrieve running applications This permission is of moderate impact. It will allow an application to find out what other applications are running on your phone. While not a danger in an of itself, it would be a useful tool for someone trying to steal your data. Typical legitimate applications that require this permission include: task killers and battery history widgets.
System tools – set preferred applications This permission is of moderate impact. It will allow an application to set the default application for any task in Android. For instance clicking on a hyperlink in your email will bring up a browser. However if you have more than one browser on your phone, you may want to have one set as your ‘preferred’ browser. Typical legitimate applications that require this permission include any applications that replace, compliment, or augment default Android functionality. Examples of this include web browsers, enhanced keyboards, email applications, Facebook applications and many more.
Hardware controls – control vibrator This permission is of low importance (but could be lots of fun). As it states, it lets an app control the vibrate function on your phone. This includes for incoming calls and other events.
Hardware controls – take pictures This permission is of low importance. As it states, it lets an app control the camera function on your phone.
Your accounts – discover known accounts This permission is of low importance. As far as I can tell it just tells the application if you have a Google account/Facebook account, but doesn’t tell the application anything about that account.
This is a guest post by Nabeel Ahmed who is an enthusiastic new blogger who writes about Technology, Wordpress & Social Media on Mushive. You can also follow him on twitter @mushive
