Android Permissions Security

Android permissions control access to protected system resources and
user data. A permission by itself does not necessarily indicate a
security vulnerability.

Dangerous Permissions:
Dangerous permissions provide access to sensitive resources such as
contacts, location, camera, microphone, phone information, or SMS data.
Applications should request only permissions required for their intended
functionality.

Excessive Permissions:
Requesting sensitive permissions that are unrelated to the application's
functionality may indicate excessive privilege and should be reviewed.

READ_SMS:
READ_SMS allows an application to read SMS messages. SMS messages may
contain private communications, authentication codes, verification codes,
and other sensitive information.

READ_CONTACTS:
READ_CONTACTS allows access to the user's contacts. Unnecessary access
can expose personal information and should be reviewed.

ACCESS_FINE_LOCATION:
ACCESS_FINE_LOCATION provides precise location information. Applications
should request it only when location functionality requires precise
location data.

CAMERA:
CAMERA allows access to the device camera. Unnecessary camera access
can expose sensitive visual information.

RECORD_AUDIO:
RECORD_AUDIO allows access to the microphone. Unnecessary microphone
access may expose private conversations or environmental audio.

READ_PHONE_STATE:
READ_PHONE_STATE may expose information related to the device or
telephony state. Its necessity should be evaluated based on application
functionality.

INTERNET:
INTERNET allows network communication. The presence of INTERNET alone
is not a vulnerability because many legitimate applications require
network access.

Permission Count:
A high number of permissions may indicate a broad application attack
surface, but permission count alone does not establish a vulnerability.

Permission Assessment:
A permission should be evaluated in the context of the application's
purpose and observed behavior.

Important:
The presence of a dangerous permission does not automatically mean
that a vulnerability exists.

Strong Evidence:
If dynamic analysis demonstrates that sensitive data is actually accessed
using a sensitive permission, this provides stronger evidence than merely
declaring the permission in the manifest.