News for hackers. Stuff that matters.

A comment on 2FA app with 10k Google Play downloads loaded well-known banking trojan. Parent comment

Re:2FA app with 10k Google Play downloads loaded well-known ... by alexbakker on Friday January 28, 2022 @01:47PM (#30118726)
> android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).

This is incorrect. If an app doesn't specify this permission in its manifest, it cannot access the internet.

[ Parent | on HN ]
Re:2FA app with 10k Google Play downloads loaded well-known ... by UncleMeat on Friday January 28, 2022 @03:33PM (#30119954)
Is that true? I was under the impression that this changed years ago since virtually every app requested it anyway.

Apps could always send content over the internet by sending an intent to a browser with relevant GET parameters to whatever server is consuming the data.

[ Parent | on HN ]
Re:2FA app with 10k Google Play downloads loaded well-known ... by mdp2021 on Saturday January 29, 2022 @08:25AM (#30126089)
Investigating, but the Android Developers page at https://developer.android.com/training/basics/network-ops/co... still states that

«To perform network operations in your application, your manifest must include the following permissions: ... .INTERNET and ... .ACCESS_NETWORK_STATE»

Though yes, applications (with particular regard to those that did not open network sockets internally) could use intents to have other applications perform network operations.

[ Parent | on HN ]