News for hackers. Stuff that matters.

A comment on A list of all Android permissions.

Re:A list of all Android permissions by smilliken on Sunday October 02, 2016 @11:05PM (#12625347)
At my company (MixRank), we do static analysis on apps for business intelligence. We've collected lots of data on permissions, SDKs, integrations, frameworks, etc. If anyone has any interesting queries they'd like me to run, I can give it a shot.

Here's the most popular permissions we've identified:

                            permission                         |  apps   | pct_apps 
   ------------------------------------------------------------+---------+----------
    android.permission.INTERNET                                | 2607544 |    92.90
    android.permission.ACCESS_NETWORK_STATE                    | 2332429 |    83.10
    android.permission.READ_EXTERNAL_STORAGE                   | 1707550 |    60.83
    android.permission.WRITE_EXTERNAL_STORAGE                  | 1696178 |    60.43
    android.permission.READ_PHONE_STATE                        | 1154963 |    41.15
    android.permission.WAKE_LOCK                               |  989176 |    35.24
    android.permission.ACCESS_WIFI_STATE                       |  944675 |    33.65
    android.permission.ACCESS_FINE_LOCATION                    |  798122 |    28.43
    android.permission.ACCESS_COARSE_LOCATION                  |  770878 |    27.46
    android.permission.VIBRATE                                 |  734366 |    26.16
    com.google.android.c2dm.permission.RECEIVE                 |  687083 |    24.48
    android.permission.GET_ACCOUNTS                            |  676143 |    24.09
    android.permission.CAMERA                                  |  436581 |    15.55
    android.permission.RECEIVE_BOOT_COMPLETED                  |  429658 |    15.30
    android.permission.RECORD_AUDIO                            |  243793 |     8.68
    android.permission.GET_TASKS                               |  235717 |     8.39
    android.permission.CALL_PHONE                              |  218079 |     7.76
    com.android.vending.BILLING                                |  200927 |     7.15
    android.permission.READ_CONTACTS                           |  190848 |     6.79
    com.google.android.providers.gsf.permission.READ_GSERVICES |  188162 |     6.70
    android.permission.SYSTEM_ALERT_WINDOW                     |  176363 |     6.28
    com.android.launcher.permission.INSTALL_SHORTCUT           |  164649 |     5.86
    android.permission.SET_WALLPAPER                           |  156845 |     5.58
    android.permission.ACCESS_LOCATION_EXTRA_COMMANDS          |  131898 |     4.69
    android.permission.WRITE_SETTINGS                          |  122783 |     4.37
    android.permission.USE_CREDENTIALS                         |  110675 |     3.94
    android.permission.BLUETOOTH                               |  106272 |     3.78
    android.permission.MODIFY_AUDIO_SETTINGS                   |  102882 |     3.66
    android.permission.SEND_SMS                                |   97892 |     3.48
    android.permission.WRITE_CONTACTS                          |   97585 |     3.47
    com.android.browser.permission.READ_HISTORY_BOOKMARKS      |   97147 |     3.46
    android.permission.CHANGE_WIFI_STATE                       |   97074 |     3.45
    android.permission.READ_CALL_LOG                           |   90001 |     3.20
    com.android.vending.CHECK_LICENSE                          |   79279 |     2.82
    android.permission.BLUETOOTH_ADMIN                         |   78199 |     2.78
    android.permission.FLASHLIGHT                              |   74952 |     2.67
    android.permission.RECEIVE_SMS                             |   73898 |     2.63
    android.permission.BROADCAST_STICKY                        |   67092 |     2.39
    android.permission.DISABLE_KEYGUARD                        |   66887 |     2.38
    com.android.browser.permission.WRITE_HISTORY_BOOKMARKS     |   65765 |     2.34
    android.permission.READ_CALENDAR                           |   61989 |     2.20
    android.permission.WRITE_CALENDAR                          |   61327 |     2.18
    android.permission.READ_LOGS                               |   60059 |     2.13
[ Parent | on HN ]
Re:A list of all Android permissions by digi_owl on Monday October 03, 2016 @12:41AM (#12625548)
Iirc, since Android 6 (though really introduced in a earlier Play store update) quite a number of the network related permissions is accepted by default.

This because Google switched to putting different permissions into bins, and the networking bin is accepted by default. Note also that these days a user is only notified if a update introduces a new bin requirement, not on every permission change.

[ Parent | on HN ]
Re:A list of all Android permissions by nitrogen on Monday October 03, 2016 @04:48AM (#12626070)
I find it bothersome that basically any app could potentially portscan your network and sell the map.
[ Parent | on HN ]
Re:A list of all Android permissions by lmm on Monday October 03, 2016 @10:01AM (#12627467)
Best to design your security model assuming all attackers have access to the output of a portscan in any case.
[ Parent | on HN ]
Re:A list of all Android permissions by nitrogen on Monday October 03, 2016 @05:53PM (#12631671)
True, but there are significant privacy implications.
[ Parent | on HN ]
Re:A list of all Android permissions by qmarchi on Monday October 03, 2016 @12:09AM (#12625478)
Can you pull the list of apps that didn't match a specific filter? I'm curious to know what apps dont use permission.INTERNET
[ Parent | on HN ]
Re:A list of all Android permissions by smilliken on Monday October 03, 2016 @12:26AM (#12625515)
There's 126k android apps we have without that permission.

Here's the top 250:

https://mixrank.com/playstore/apps?expiration=2016-11-03&pag...

[ Parent | on HN ]
Re:A list of all Android permissions by EnigmaticLion on Monday October 03, 2016 @01:09AM (#12625609)
Maybe i misunderstand what permission.INTERNET permission means, but i fail to see how Google Play Games is not using the internet.
[ Parent | on HN ]
Re:A list of all Android permissions by smilliken on Monday October 03, 2016 @01:48AM (#12625671)
See digi_owl's comment. In addition to that, Google Play Games does inter-process communication with Google Play Services which essentially has unfettered permissions.
[ Parent | on HN ]
Re:A list of all Android permissions by pdkl95 on Monday October 03, 2016 @05:44AM (#12626215)
I find it hard to believe that more than 1 app in 4 has a legitimate need for (fine!) location data.

    android.permission.ACCESS_FINE_LOCATION    |  798122 |    28.43
    android.permission.ACCESS_COARSE_LOCATION  |  770878 |    27.46
There might be a legitimate reason that 1 app in 8 needs access to the camera, but that also seems a high.

    android.permission.CAMERA                  |  436581 |    15.55
[ Parent | on HN ]
Re:A list of all Android permissions by octo_t on Monday October 03, 2016 @05:54AM (#12626246)
not an android user, but plenty of iOS apps want to access the camera for 'ease of use' things.

* Banking apps/shopping want access to the camera to scan your debit/credit/gift cards, instead of having to type it out.

* messaging apps/email etc want access to the camera so you can msg/email photos

* games that are vaguely 'social' and want to have a real photo of you as an in-game avatar etc.

[ Parent | on HN ]
Re:A list of all Android permissions by pdkl95 on Monday October 03, 2016 @09:00AM (#12627090)
> Banking apps/shopping want access to the camera to scan your debit/credit/gift cards, instead of having to type it out.

I forgot about that type of use, which makes the camera usage rate a lot more reasonable.

[ Parent | on HN ]
Re:A list of all Android permissions by throwawayReply on Monday October 03, 2016 @06:11AM (#12626293)
It's READ_PHONE_STATE that worries me, correct me if I'm wrong but isn't that phone meta-data? (Who is calling, when, etc?)
[ Parent | on HN ]
Re:A list of all Android permissions by BellsOnSunday on Monday October 03, 2016 @06:59AM (#12626434)
You need this ominous sounding permission to intervene and pause an app when a call comes in.
[ Parent | on HN ]
Re:A list of all Android permissions by Arinerron on Monday October 03, 2016 @02:58AM (#12625822)
Hey. Mind sorting the gist list in order of most to least used? I'd really appreciate it.
[ Parent | on HN ]
Re:A list of all Android permissions by amund on Monday October 03, 2016 @03:20AM (#12625872)
Hi, see your company also tracks SDKs. Wonder how many/which top apps use Crashlytics?
[ Parent | on HN ]
Re:A list of all Android permissions by smilliken on Monday October 03, 2016 @02:19PM (#12629939)
We've found 33k+ iOS apps with Crashlytics. Here's the top 10:

https://mixrank.com/appstore/apps?expiration=2016-11-03&sdk_...

We've found 49k+ android apps with Crashlytics. Here's the top 10:

https://mixrank.com/playstore/apps?expiration=2016-11-03&sdk...

[ Parent | on HN ]