Can an app call a phone without me knowing?

Question

The reason I ask is because I have gotten various calls from seemingly random numbers saying that I had called them. When I check my call log, there is no outgoing call to their number.

This has happened multiple times, but not very often, maybe once every two weeks. I am normally very careful with the apps that I download and have avg downloaded and scanning periodically. Could it be that someone else can use the same number to call?

Anecdotal: I've called a friends number that I know was right, rang it several times, every time I was put through to an increasing irate lady. I assume the networks routing was messed up somehow, eventually it sorted its self outself out. How long has your problem been going on? — Peanut, Sep 17 '13 at 22:09
@Peanut It's happened about 4 times in the past month and a half, and I'm not sure it's really an issue. Now that I think of it, when It happens, I am in a really bad signal zone, so that might contribute. — farraman, Sep 18 '13 at 15:51

score 11 · Accepted Answer · edited Sep 18 '13 at 13:33

11

An app with the appropriate permissions can not only initiate calls without you knowing, but also remove all evidence from your call logs:

CALL_PHONE: Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.
WRITE_CALL_LOG: Allows an application to write (but not read) the user's contacts data.

^{(Source: Manifest Permissions).}

If your provider supports a full call listing on your bill: that's a place no app can touch, so there you would find evidence.

Though it is technically possible somebody else could fake your number, that's rather unlikely. To do this, one would need some privileges a normal phone connector doesn't offer; so this person must either sit at a provider's site directly, or at some (usually bigger) company with the appropriate privileges granted.

To help you isolating the possible culprit, there are several tools available. I'd suggest to take a look at something like Permission Explorer:

^{Permission Explorer (Source: Google Play; click images to enlarge)}

As you can see, this app allows browsing by category, and nicely lists up all installed apps with a given permission. You can most likely skip system apps here, then see what's left and re-check playstore comments on suspicious apps. I also recommend checking on AppBrain, as they often point out malicious apps: Use their search page and see if the result for your app is "minimized", which already is one indicator. Also a good idea: try AppBrain Ad Detector, which does the same for apps on your device:

^{AppBrain Ad Detector (Source: Google Play; click images to enlarge)}

Additional benefit of this app: it automatically alerts you when you install an app with suspicious permissions ("Live Detection Mode" triggers on app install).

edited Sep 18 '13 at 13:33

ale

19,723
34
110
159

answered Sep 17 '13 at 22:09

Izzy

91,166
73
343
943

Thanks for the info. I will double check with my provider to see if they have any call logs that I can't account for and will certainly go through my apps and their permissions. – farraman Sep 17 '13 at 23:02
Good ideas both. I will just update my answer to include some helpers for the latter. – Izzy Sep 18 '13 at 06:00
Great ideas, Permission Explorer looks promising. I'm sure what's happening in my case is a non-issue, but it helps to be sure. I was just wondering if it was possible for an app to do so. – farraman Sep 18 '13 at 15:50
Such things are sometimes even desired. Think of an app which should conditionally forward incoming calls (from a given number/pattern), or emergency apps in the security area ("Dead-man-Switch": If not hit within x mins, call someone for help because you're probably knocked-down; useful in dangerous areas (not limited to crime, think e.g. of climbing a rock), and such apps do exist). – Izzy Sep 18 '13 at 16:06
1

Why is the WRITE_CALL_LOG permission even given out as a permission for developers to exploit? Is there a real use case for it? – Munim Sep 25 '13 at 11:09
1

@Munim sure there is. Think about a "Call Prefixer" (which adds a prefix to e.g. place an "incognito call"). You don't want that prefix in your list, maybe. So the "Prefixer" needs to rewrite that entry. – Izzy Sep 25 '13 at 11:43
@Izzy Heh.. I am sorry, but I don't incognito call mode on a phone is a good idea. I can already think of ways it can be misused. I'd rather that the user had manual control over the full log himself. – Munim Sep 25 '13 at 11:47
If you use it is up to you. Even dumb phones support incognito calls (via the very same GSM code prefixes, e.g. #31#012345). This is a real use-case, even if not for you – but you are one and we are many :) Furthermore, that was just one example (and no, this is not a discussion, so no more of that here. Feel free trying in chat ;) And in order for the user to have full control, the user needs an app for that, which needs that permission. Ooops? :D – Izzy Sep 25 '13 at 13:39
Spoofing a number is easier than you make out, using a service known as http://spoofcard.com – Liam W Sep 14 '14 at 09:50

Can an app call a phone without me knowing?

1 Answers1

Linked

Related