APK Permission Security Analysis
快速回答
Permission risk comes from capabilities the product does not explain.
Permission risk comes from capabilities the product does not explain. Review the merged manifest, not only the app module, and treat accessibility, SMS and overlay as high severity until justified.
APK permission security analysis is reading what the package is allowed to do, then asking whether that matches the product.
Merged manifest
Gradle libraries merge permissions you never typed. Analyze the APK, not the app module's AndroidManifest.xml only.
Dangerous permissions
Camera, location, contacts, SMS, storage — each needs a feature story. A puzzle game with SMS is a finding.
Special access
Accessibility, notification listener, overlay (SYSTEM_ALERT_WINDOW), device admin. These enable malware patterns. They also appear in legitimate password managers and parental controls — the product story must be strong.
Combinations
Overlay + accessibility is a classic overlay-attack kit. SMS + contacts is harvesting. Do not score permissions one-by-one only.
If the set is hostile, you can stop without decompilation. See analyze for malware and is it safe.
要点
- Risk comes from permissions that the product does not explain.
- Library manifests often add surprise permissions.
- Accessibility + overlay + SMS is a malware-shaped set until proven otherwise.
实践指引
- 01Map every dangerous or special permission to a user-visible feature.
- 02Inspect the merged manifest, not only the app module.
下一步怎么做
常见问题
Is INTERNET a security finding?
By itself, no. Almost every app needs it. Combine with cleartext, unexpected hosts, or overlay phishing.
What about QUERY_ALL_PACKAGES?
It is sensitive. Demand a product reason. Many sideload clones use it to target banks and messengers.
Can Play policy replace this review?
No. Policy is a floor. Your threat model may be stricter.
相关问题