4

I saw a number of apps that require "Services that cost you money" permissions, my question is if I install such an app and that app will make a phone call, is that call visible to the user or the app can make the call in the background without the user knowing ?

I usually don't install apps that require extending permissions and I haven’t found anything googling, I prefer not to install it unless I'm sure I won't have a surprise when my phone bill comes.

Specifically I was invited to join a conference via GoToMeeting and their Android app is requesting the above permission.

Radu Maris
  • 143
  • 1
  • 5

1 Answers1

6

I am an Android Application developer. I had a requirement to make phone verification. In that case we had to make a telephony call to our server. But we could't achieve that as Android system does not allow us to make a phone call without users interaction. The best we can do is populate the phone number in the default dialer app. In any case user has to press call button. So I would say No app can make a phone call without your permission.

But

We can send SMS in from background and it will cost you money. For this you will see something like this before installing app:

enter image description here

Gem
  • 176
  • 3
  • 2
    Let's say I'm trying to make a malicious app to dial out without you knowing. Why can't I set a layer over the dialer app and have a layer over the button to dial out, the user won't know they clicked a button in their dialler as opposed to my app at any point, and I can draw over other applications UI with my app so they won't see anything dialing but the call will be going. Is that not possible? – RossC Jan 29 '14 at 09:16
  • 2
    No RossC its not possible. When you touch any button in application we receive its even in out application. Now when we have the event we can forward that event to other button or any other control. But that control must be on the same screen (technically Activity). So the dialler app not the part of any malicious app so it not possible at all. – Gem Mar 27 '14 at 07:58
  • The permission CALL_PHONE is described as "Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed." So I wonder: Is that description wrong – or did you miss it? Your screenshot doesn't show your app requested this. Protection level here is "dangerous", so any app can request it (as opposed to CALL_PRIVILEGED, which is reserved to system apps). – Izzy Jan 06 '15 at 23:35