An Avast security researcher has discovered that Android upon flashlight apps request a large number of permissions installation, while most do not provide the necessary functionality in return.
The researcher said he examined all the Android flashlight apps available on the Play Store. In total, he found 937 apps. Seven of them were actually malicious .
The researcher found that the majority of apps requested many permissions (average: 25 permissions/app).
However, these permissions are excessive for these apps. In reality, they don't need more than 1-2 permissions to function properly. Furthermore, most cell phones these days have a flashlight, so these apps aren't even useful (for most people).
A few years ago, flashlight apps were very popular. Developers discovered that they could turn a phone's camera into a flashlight, and that was very useful. However, in the past 5-6 years, Android devices have started to have a built-in flashlight, and now most phones don't need such apps.
However, users with older devices still rely on them.
Why do flashlight apps need so many permissions?
Sure, some permissions are needed for apps to function . However, the researcher wonders: “If 408 of the apps only need 10 or fewer permissions, why are there 262 apps that require 50 or more permissions?”
The researcher found 77 flashlight apps requesting more than 50 permissions. That number is outrageous. It's about a third of the total number of permissions supported by the Android OS.
Furthermore, very few apps justified the permissions they requested.
The information they were requesting access to was absurd. A large number (77) were requesting permission to record audio, while 180 apps were requesting access to the user's contacts. All of these permissions are not needed for the flashlight to function properly.
Other permissions related to managing calls and messages, accessing location , etc.
All of this information, which applications request access to, can be used by malware to harm users.
A common tactic of hackers is to create simple, “innocent” applications that can attract many users. These applications usually request a large number of permissions. Then, once the hackers have access to the information they want, they can install malware in the applications and harm users. (They can of course also affect third-party applications, and not create them themselves)
App developers can make an update and turn flashlight apps into malware.
If this happens, hackers can steal data or install malware on their device.
Check the permissions before installing any app
Researchers recommend paying close attention to the permissions that applications request.
" Google doesn't have a good reputation for keeping malware out of the Play Store. Be wary of apps that request excessive permissions. It could be a sign that they're malicious."
The Avast researcher said that it is essential to check permissions before installing an app. If we don't understand or don't like something about what it is asking for, then it is best not to download the app.
