Android security: Permission based attacks

The major concern that comes in the way of Android's popularity is Security. Android Security is gaining paramount importance because vast number of mobile user are using Android based phones. Android Permission System provides the mechanism to grant access rights to the third party applications so that they can access resource from the user's device. User is responsible to grantor deny permissions required for the installation of app. It is an “All or Nothing approach”. Most of the times users do not pay attention to the requested permissions or sometimes they don't even understand the meaning of those permissions and just install the applications. This paves the way for attackers to perform the malicious task by asking for more than required set of permissions. These extra permissions allow the attacker to exploit the device and retrieve sensitive information from it. This paper discusses the permission based attacks in details and designs an app to showcase how allowing a single extra permission can cause severe impact on user's privacy.