Trend Micro - When Android apps want more than they need

8/3/2019 Trend Micro - When Android apps want more than they need

1/12


2/12

WHENANDROIDAPPS WANT

MORE THANTHEY NEED

Understanding App Permissions

* The Android Robot that appears in this e-book was made available by Googleunder the terms of the Creative Commons Attribution License.
http://creativecommons.org/licenses/by/3.0/legalcodehttp://creativecommons.org/licenses/by/3.0/legalcode


3/12

So you just bought a new Android-based smartphone, what comesnext? What else but the most exciting partdownloading the rightapps to boost its functionality. You may even want to download a

game or two or a movie or an MP3 player. Android gives you thefreedom to personalize your device, which has made it attractive tothose who want their smartphones to be as unique as possible.

The freedom to personalize an Android-based smartphone as much asone wants and the wide variety of apps available on the Android Marketare just two of the reasons why the OSs popularity continues to soar.

Canalys, in a recent report, said that almost 50 percent of over 107 millionsmartphones shipped worldwide in the second quarter of 2011 wereAndroid based. More than 39 million Android-based smartphones, it

said, were shipped to Asia/Pacic.A Nielsen report further stated that Android led in terms of bothmarket share and data usage in the United States. Whatsmore, Nielsen also believes that Android-baseddevice users installed an average of 35 apps each.
http://www.canalys.com/newsroom/android-takes-almost-50-share-worldwide-smart-phone-markethttp://blog.nielsen.com/nielsenwire/consumer/android-leads-u-s-in-smartphone-market-share-and-data-usage/http://blog.nielsen.com/nielsenwire/online_mobile/consumers-and-mobile-apps-in-the-u-s-all-about-android-and-apple-ios/http://blog.nielsen.com/nielsenwire/online_mobile/consumers-and-mobile-apps-in-the-u-s-all-about-android-and-apple-ios/http://blog.nielsen.com/nielsenwire/consumer/android-leads-u-s-in-smartphone-market-share-and-data-usage/http://www.canalys.com/newsroom/android-takes-almost-50-share-worldwide-smart-phone-market


4/12

APPS SEEKPERMISSIONS IN

ORDER TO WORKThink of an Android app as a hotel guest. Each guest gets an accesscard, which allows him/her to enter his/her room, the lobby, the bar,and maybe some other parts of the hotel. This card, however, doesnot give him/her access to the kitchen or to the hotelmanagers ofce.

Like a hotel guest, every Android appyou install on your device needs certain

permissions or an access card inorder to work. The permissions yougive each app tells it which of theavailable resources on your device itcan use.

Many apps extend an Android-baseddevices functionality. As such, not allapps that seek several permissions aremalicious in nature.

No single list of permissions forAndroid-based devices exists. All of

the permissions that apps usually seekare, however, listed in the AndroidSoftware Development Kit (SDK)forapp developers.

The Android Developers site alsoprovides the so-called Manifest.

permission list, which enumerates thepermissions that apps basically need towork on an Android-based device.
http://developer.android.com/sdk/index.htmlhttp://developer.android.com/sdk/index.htmlhttp://developer.android.com/reference/android/Manifest.permission.htmlhttp://developer.android.com/reference/android/Manifest.permission.htmlhttp://developer.android.com/reference/android/Manifest.permission.htmlhttp://developer.android.com/reference/android/Manifest.permission.htmlhttp://developer.android.com/reference/android/Manifest.permission.htmlhttp://developer.android.com/sdk/index.htmlhttp://developer.android.com/sdk/index.html


5/12

Seeking users permissionto access certain featuresis meant to prevent the

spread of malicious appsamong Android-baseddevices. This is the reasonwhy cybercriminals haveresorted to Trojanizinglegitimate apps in order to

infect devices and to carryout malicious deeds.

At present, almost250,000 apps are availablefor download in the AndroidMarket. Androids huge

user base is probablycybercriminals mainmotivation for making themdata theft targets.
http://investor.google.com/webcast.htmlhttp://investor.google.com/webcast.htmlhttp://investor.google.com/webcast.htmlhttp://investor.google.com/webcast.html


6/12

GRANTINGTOO MANY

PERMISSIONSCAN LEAD TO

HARMApps ask you for certain permissions in order to work beforethese are even installed. Make sure you carefully read apps end-

user license agreements (EULAs), as these will give you a clearidea as to their intent. Apps rely on the permissions you grantthem to do what they are supposed to.

Many apps seek your permission to grant them network access so they

can download updates. Some apps seek permission to read your phonesstate and identity so calls wont disrupt them from doing what theyredoing. Unfortunately, these permissions can be abused by Trojanizedapps to perform malicious deeds like record your conversationsand send device information like International Mobile EquipmentIdentity (IMEI) number to a command center.


7/12

Apps allow you to view the permissions yougave them after installation. To do this on anAndroid 2.2. (Froyo)-based phone, go to

Settings > Applications > ManageApplications. Choose the app whosepermissions you wish to see and scrollaway to nd out.

In August 2010, we spotted therst Android Trojan, which sent

text messages to certainnumbers. Most of the Androidmalware we came across since thenperform one or a combination of maliciousactivities like stealing data (data stealers);allowing remote access (backdoor apps); accessing

fraudulent sites (click-fraud enablers); listening to calls andreading personal text messages and contact information(mobile spies); downloading other malware (downloaders);and gaining root or administrative privileges(rooting enablers).
http://blog.trendmicro.com/first-android-trojan-in-the-wild/http://blog.trendmicro.com/first-android-trojan-in-the-wild/http://blog.trendmicro.com/first-android-trojan-in-the-wild/http://blog.trendmicro.com/first-android-trojan-in-the-wild/http://blog.trendmicro.com/first-android-trojan-in-the-wild/http://blog.trendmicro.com/first-android-trojan-in-the-wild/


8/12

Weve listed down the permissions the Trojanized apps weve so far seenusually sought.

Network communicationEnabling Network communication allows apps to access the Internet or

Bluetooth-enabled devices. This is the most abused Android permissionbecause malicious apps need Internet access to communicate with their

command centers or to download updates. Granting apps thispermission allows mobile spies and data stealers to send theinformation they steal to remote users. Leaving your device

discoverable via Bluetooth may also allow future Android malwareto infect it like old Symbian OS malware.

Services that cost you moneyThe rst Android Trojan abused this permission, aka Send textmessages, along with the Phone calls and Storage permissions.Granting these allowed it to send text messages to specicpremium numbers, which cost affected users a lot of money forpremium services they dont even use. In this kind of ruse, thecybercriminals can pay for certain premium numbers in order toturn a prot from every text message an infected Android-baseddevice sends.

Phone callsWeve also seen malware abuse this permission to steal call logs offinfected Android-based devices. The log le is saved as a .TXT le andsent to a command center. Call logs are favorite targets of data stealersbecause these provide more information on affected users. Grantingmalicious apps Phone calls permission allows them to record yourconversations and steal text messages. This puts those who use

their devices to conduct online banking transactions at evengreater risk, as credentials given out over the phone or via SMSmay land on cybercriminals eagerly waiting hands.
http://blog.trendmicro.com/symbian-malware-gives-love-and-beauty-and-sex-a-bad-name/http://blog.trendmicro.com/symbian-malware-gives-love-and-beauty-and-sex-a-bad-name/http://blog.trendmicro.com/symbian-malware-gives-love-and-beauty-and-sex-a-bad-name/http://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_NICKISPY.Ahttp://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_NICKISPY.Ahttp://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_NICKISPY.Ahttp://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_NICKISPY.Ahttp://blog.trendmicro.com/symbian-malware-gives-love-and-beauty-and-sex-a-bad-name/


9/12

System toolsSome of the malware weve seen abuse permissions like

Automatically start at boot, Change Wi-Fi state, Change networkconnectivity, and Prevent from sleeping, which allowed them

to run their own malicious services. Case in point: A game appdoesnt need to automatically start every time your phoneboots up so it doesnt need to seek permission to do so. In fact,

this is a very strong indication that what it really wants to do is

to silently run a malicious service in the background every timeyour phone boots up.

StorageGranting an app permission to modify or delete your secure data (SD)

cards contents allows it to read, write, and/or delete anything fromit. Data stealers can abuse this permission to store a copy of the

information theyve stolen or to save a .TXT, an .INI, or a similar letype on your SD card before this is sent to a command center. It

also gives a malicious app the capability to overwrite existing leson your SD card.

Your locationOne of the more notable Android data stealers we found sought

permission to see where the user is geographically located. Note thatinformation like this can be used to instigate real-world crimes likestalking. Online, this may be handy when dishing out region-specic

spam or malware.

Most of the Android malware weve seen sought at least three permissions thatwere quite unusual for their intended use. This is a good indicator of illegitimacywhen installing apps. Think very carefully about the permissions you are

granting an app before actually giving your go signal.ANDROIDOS_SPYGOLD.A,which Trojanized Fast Racing, for instance, sought several permissions thatsuch a game app wouldnt normally need in order to work.
http://blog.trendmicro.com/malicious-android-app-spies-on-users-location/http://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_SPYGOLD.Ahttp://about-threats.trendmicro.com/Malware.aspx?language=us&name=ANDROIDOS_SPYGOLD.Ahttp://blog.trendmicro.com/malicious-android-app-spies-on-users-location/


10/12

HOW TO AVOIDGRANTING

APPS TOOMUCH ACCESSRemember that because Android gives you the freedom to installany app you want, the responsibility of keeping your device malwarefree lies in your hands.

For more tips and tricks on keeping your data safe from maliciousapps, read our e-book, 5 Simple Steps to Secure Your Android-

Based Smartphones. Keep these three tips in mind as well to avoidgranting apps too much access:

1. Read up about an app prior to downloading and installing it. Findout who created it and read what other users have to say about theapp and its developer by browsing through related comments in the

Android Market or in any third-party app store. It is also a good idea tocheck the apps store rating.

Keep in mind, however, that a lot of malware Trojanize legitimate appsin order to lure users like you into downloading them.
http://about-threats.trendmicro.com/ebooks/5-simple-steps-to-secure-your-android-based-smartphones/#/1/http://about-threats.trendmicro.com/ebooks/5-simple-steps-to-secure-your-android-based-smartphones/#/1/http://about-threats.trendmicro.com/ebooks/5-simple-steps-to-secure-your-android-based-smartphones/#/1/http://blog.trendmicro.com/trojanized-apps-root-android-devices/http://blog.trendmicro.com/trojanized-apps-root-android-devices/http://about-threats.trendmicro.com/ebooks/5-simple-steps-to-secure-your-android-based-smartphones/#/1/http://about-threats.trendmicro.com/ebooks/5-simple-steps-to-secure-your-android-based-smartphones/#/1/


11/12

2. Carefully read and understand the permissions an app seeks.Remember that most Trojanized apps come in the guise of legitimateones. These just happen to seek more permissions than they actually

need in order to work.If you downloaded and installed a media player, for instance, that seekspermission to send text messages, think again before accepting itsterms of agreement. Even though some legitimate apps seek severalpermissions, there is such a thing as asking for too many permissionsthat can put your device and your data in grave danger.

3. Investing in a mobile security software that protects not just yourphone but also the data stored in it is also a great idea. Solutions likeTrend Micro Mobile Security Personal Edition can identify and stopmalware before these even reach your phone. Backed by the sametechnologies behind the Trend Micro Smart Protection Network,it effectively protects your Android-based devices against the

latest malware.
http://us.trendmicro.com/us/products/personal/mobile-security-for-android/http://us.trendmicro.com/us/trendwatch/cloud/smart-protection-network/http://us.trendmicro.com/us/trendwatch/cloud/smart-protection-network/http://us.trendmicro.com/us/products/personal/mobile-security-for-android/


12/12

TREND MICRO

Trend Micro, Incorporated is a pioneer in secure content and

threat management. Founded in 1988, Trend Micro provides

individuals and organizations of all sizes with award-winning

security software, hardware and services. With headquarters

in Tokyo and operations in more than 30 countries, Trend

Micro solutions are sold through corporate and value-added

resellers and service providers worldwide. For additional

information and evaluation copies of Trend Micro products

and services, visit our website at www.trendmicro.com.

2011 by Trend Micro, Incorporated. All rights reserved. Trend

Micro and the Trend Micro t-ball logo are trademarks orregistered trademarks of Trend Micro, Incorporated. All otherproduct or company names may be trademarks or registeredtrademarks of their owners.

TREND MICRO INC.

10101 N. De Anza Blvd.

Cupertino, CA 95014

US toll free: 1 +800.228.5651

Phone: 1 +408.257.1500

Fax: 1 +408.257.2003

www.trendmicro.com
http://c/Users/bernadetteca/AppData/Local/Adobe/InDesign/Version%206.0/en_US/Caches/InDesign%20ClipboardScrap.pdfhttp://c/Users/bernadetteca/AppData/Local/Adobe/InDesign/Version%206.0/en_US/Caches/InDesign%20ClipboardScrap.pdfhttp://c/Users/bernadetteca/AppData/Local/Adobe/InDesign/Version%206.0/en_US/Caches/InDesign%20ClipboardScrap.pdfhttp://c/Users/bernadetteca/AppData/Local/Adobe/InDesign/Version%206.0/en_US/Caches/InDesign%20ClipboardScrap.pdf

Trend Micro - When Android apps want more than they need

Documents

Transcript of Trend Micro - When Android apps want more than they need