Android phone security, Any advice ?

thegoodman

I don't get it, why would accu weather app need to do the following:
1. SEND SMS MESSAGES
2. DIRECTLY CALL PHONE NUMBERS
3. ADD OR MODIFY CALENDAR EVENTS AND SEND EMAIL TO GUESTS WITHOUT OWNERS' KNOWLEDGE
4. READ CALENDAR EVENTS PLUS CONFIDENTIAL INFORMATION
5. READ PHONE STATE AND IDENTITY

It's a weather app, why would it need access to points 1 to 5. And DUTR is happy to use the app.

The point 1 is the main problem, the app can send a text to join some kind of chargeable text service. The user will end up paying to receive text messages.

The app is available on Google Play.

By the way DUTR the point 2 is to dial out and make telephone calls, not data.
The full list can be found below
https://play.google.com/store/apps/details?id=com.accuweather.android.tablet&feature=more_from_developer#?t=W251bGwsMSwxLDEwMiwiY29tLmFjY3V3ZWF0aGVyLmFuZHJvaWQudGFibGV0Il0.

How is average Android user is going to tell if the app is malware or not?
This is just one app, many apps and games need access to make telephone calls and to send text messages?

DUTR

thegoodman wrote: »

I don't get it, why would accu weather app need to do the following:
1. SEND SMS MESSAGES
2. DIRECTLY CALL PHONE NUMBERS
3. ADD OR MODIFY CALENDAR EVENTS AND SEND EMAIL TO GUESTS WITHOUT OWNERS' KNOWLEDGE
4. READ CALENDAR EVENTS PLUS CONFIDENTIAL INFORMATION
5. READ PHONE STATE AND IDENTITY

It's a weather app, why would it need access to points 1 to 5. And DUTR is happy to use the app.

The point 1 is the main problem, the app can send a text to join some kind of chargeable text service. The user will end up paying to receive text messages.

The app is available on Google Play.

By the way DUTR the point 2 is to dial out and make telephone calls, not data.
The full list can be found below
https://play.google.com/store/apps/details?id=com.accuweather.android.tablet&feature=more_from_developer#?t=W251bGwsMSwxLDEwMiwiY29tLmFjY3V3ZWF0aGVyLmFuZHJvaWQudGFibGV0Il0.

How is average Android user is going to tell if the app is malware or not?

Now then since October last year I have been using Accu weather, as soon as there is some oddity from using the app I will be the 1st to let you know, in the meantime IP5 or not, the Sony Acro S will be my next handset
Why not ask the developers why they require such permissions, in the meantime, you can let us know why apple apps were abusing the personal info on iphones, or did that slip by your google searching?

Viewing App Permissions

Apps require access to certain systems within your device. When you install an application, you will be notified of all of the permissions required to run that application. Please read and consider the permissions carefully. See below for a list of permissions and what it means for the application:

• Cost Money: Used for permissions that can be used to make the user spend money without their direct involvement.
• Development Tools: Group of permissions that are related to development features.
• Hardware Controls: Used for permissions that provide direct access to the hardware on the device.
• Your Location: Used for permissions that allow access to the user's current location.
• Messages: Used for permissions that allows an application to send messages on behalf of the user or intercept messages being received by the user.
• Network Communications: Used for permissions that provides access to networking services.
• Personal Info: Used for permissions that provide access to the user's private data, such as contacts, calendar events, e-mail messages, etc.
• Phone Calls: Used for permissions that is associated with accessing and modifying telephony state: intercepting outgoing calls, reading and modifying the phone state.
• Storage: Group of permissions that are related to SD card access.
• System Tools: Group of permissions that are related to system APIs (Application Programming Interface).

Accu weather permissions


Permissions

This application has access to the following:

• Your locationcoarse (network-based) location
  Access coarse location sources such as the cellular network database to determine an approximate tablet location, where available. Malicious apps may use this to determine approximately where you are. Access coarse location sources such as the cellular network database to determine an approximate phone location, where available. Malicious apps may use this to determine approximately where you are.
  fine (GPS) location
  Access fine location sources such as the Global Positioning System on the tablet, where available. Malicious apps may use this to determine where you are, and may consume additional battery power. Access fine location sources such as the Global Positioning System on the phone, where available. Malicious apps may use this to determine where you are, and may consume additional battery power.
• Network communicationfull Internet access
  Allows the app to create network sockets.
• Phone callsread phone state and identity
  Allows the app to access the phone features of the device. An app with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like.
• Storagemodify/delete USB storage contents modify/delete SD card contents
  Allows the app to write to the USB storage. Allows the app to write to the SD card.

Hide

• Network communicationview network state
  Allows the app to view the state of all networks.

thegoodman

Sorry DUTR, still I can't understand why would weather app need to make calls and send text messages.

Don't you think this is too risky for users?
The app may make an expensive calls or the app may be ok but some kind of malware may force the app to make calls.
Either way user will end up paying.

grumbler

DUTR wrote: »

...Please read and consider the permissions carefully. ...

The problem is that you can spend days on reading and considering this meaningless information. The only way to know is to rely on the experience of other users, but this still doesn't guarantee anything. Neither does asking the developer - if you think that this is a realistic way of acting for all potential users.

Let's face it: Android is insecure environment. Google should have provided the means for certifying apps, at least by some community, but for some mysterious reason decided not to do this.

That said, I am Android user and have not had any problems so far.

DUTR

thegoodman wrote: »

Sorry DUTR, still I can't understand why would weather app need to make calls and send text messages.

Don't you think this is too risky for users?
The app may make an expensive calls or the app may be ok but some kind of malware may force the app to make calls.
Either way user will end up paying.

Once again for the thick idiots that are reading

Accu weather permissions


Permissions

This application has access to the following:

• Your locationcoarse (network-based) location
  Access coarse location sources such as the cellular network database to determine an approximate tablet location, where available. Malicious apps may use this to determine approximately where you are. Access coarse location sources such as the cellular network database to determine an approximate phone location, where available. Malicious apps may use this to determine approximately where you are.
  fine (GPS) location
  Access fine location sources such as the Global Positioning System on the tablet, where available. Malicious apps may use this to determine where you are, and may consume additional battery power. Access fine location sources such as the Global Positioning System on the phone, where available. Malicious apps may use this to determine where you are, and may consume additional battery power.
• Network communicationfull Internet access
  Allows the app to create network sockets.
• Phone callsread phone state and identity
  Allows the app to access the phone features of the device. An app with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like.
• Storagemodify/delete USB storage contents modify/delete SD card contents
  Allows the app to write to the USB storage. Allows the app to write to the SD card.

Hide

• Network communicationview network state
  Allows the app to view the state of all networks.

the queury you have is something you have fabricated

DUTR

grumbler wrote: »

The problem is that you can spend days on reading and considering this meaningless information. The only way to know is to rely on the experience of other users, but this still doesn't guarantee anything. Neither does asking the developer - if you think that this is a realistic way of acting for all potential users.

Let's face it: Android is insecure environment. Google should have provided the means for certifying apps, at least by some community, but for some mysterious reason decided not to do this.

That said, I am Android user and have not had any problems so far.

Same here and neither has TGM, so I'm not sure why is so paranoid, I don't load many games, it is there where people could get stung, paying for hints and cheats built into the app

grumbler

https://play.google.com/store/apps/details?id=com.accuweather.android&hl=en

AccuWeather for Android

This application has access to the following:
Services that cost you money

send SMS messages
Allows the app to send SMS messages. Malicious apps may cost you money by sending messages without your confirmation.

directly call phone numbers
Allows the app to call phone numbers without your intervention. Malicious apps may cause unexpected calls on your phone bill. Note that this doesn't allow the app to call emergency numbers.
...

Your personal information

add or modify calendar events and send email to guests without owners' knowledge
...
read calendar events plus confidential information
...

DUTR

grumbler wrote: »

https://play.google.com/store/apps/details?id=com.accuweather.android&hl=en

That's strange as the link TGM posted , the permissions I simply copied and pasted, as from your link there are several versions of accu weather :eek:

thegoodman

DUTR wrote: »

That's strange as the link TGM posted , the permissions I simply copied and pasted, as from your link there are several versions of accu weather :eek:

Now it make sense why some people are tricked into receiving paid text messages. It's not just the app one need to check but also the update. The first version of app may be ok but rights can change for newer version. I bet most people update the app without checking all this.

DUTR: do you agree the current version of accu weather app asking for rights to make telephone calls and send text messages is asking for trouble.
Also before answering the post can you check your facts?
For example you are wrong about rights for accu weather.
No point in trying to create long posts to hide the facts.

Note: The information about app rights and malware mainly apply to Android phones due to unwillingness of Google to check the app before release. The Google will only take the action after the event, once so many number of people have been tricked into receiving paid text messages and also reported o Google.

The other phones such as windows phone and iPhone check the app before release to reduce the chance of malware.

thegoodman

DUTR wrote: »

That's strange as the link TGM posted , the permissions I simply copied and pasted, as from your link there are several versions of accu weather :eek:

Can you show the link which shows what you are saying is correct, for Android phones?

What you have copied to hide the facts is the rights for Sony tablet which cannot make calls. I am sure in your other posts you have said you have Android phone not Sony tablet.

Check your facts before writing as misleading facts don't help anyone.