3 ms·
Does that mean an app can, by default, override your wifi or Bluetooth setting to say, phone home for example?
by shostack 10y ago
Does that mean an app can, by default, override your wifi or Bluetooth setting to say, phone home for example?
- lazulicurio 10y agoI believe[1] so, based upon my reading of [2]. Personally, I'd be less worried about an app phoning home, and more worried about an app changing my connection to an adversarial network that could sniff on traffic, etc.[3] [1] Would love if someone with more Android expertise could chime in and confirm/deny [2] https://stackoverflow.com/questions/4374862/how-to-programatically-create-and-read-wep-eap-wifi-configurations-in-android/4374934#4374934 https://stackoverflow.com/questions/4374862/how-to-programat... [3] Note that I have little Android development experience, and have not actually tried creating a malicious proof-of-concept
- jm_l 10y agoFYI, The permission BLUETOOTH_ADMIN allows applications to discover and pair bluetooth devices, but Android system services still handle the necessary user interactions to confirm and complete the process. CHANGE_NETWORK_STATE allows apps to choose which already-enabled medium to send traffic over, but to overwrite settings the app would require WRITE_SETTINGS which is a runtime permission granted by the user. CHANGE_WIFI_STATE can send the user directly into the "Add network" Wi-Fi settings screen, but cannot change the connection without user input. Also, in general, the normal permissions are pretty heavily vetted for attack vectors. I would say that if there is a problem with Android's permissions system its that users don't read important permissions they grant, not that apps can get them without consulting the user (they can't).