Beware of permission trap in mobile applications

App permissions are an almost invisible sentinel that determines what types of data and devices your apps can access. If you've downloaded a new app or enabled a new feature, you've probably encountered a permission prompt.  Some permissions are appropriate for the application, while others may exceed the required limits. Also, some  may be downright malicious. It's important to understand which ones to accept and which ones to block.  

What do app permissions do?

The app permission popup is a dialogue between you and your mobile operating system. This window notifies you that a new application wants to access certain data or features. The app will ask for your consent to do this. These requests used to come before installation. But modern iOS versions show in-run permission prompts when you first start using the app. Android does both and only shows prompts during installation for low-risk permissions. For developers, permissions are a critical way to deliver seamless, feature-rich experiences to users. If an app had to request permission to access device data or functionality every time it used it, it would be nearly unusable. 

What are the dangers of app permissions?

Malicious or not, some apps request more access permissions than they need. For example, consider a mobile game that asks for access to your contacts or a calculator app that asks for permission to access your microphone and camera. By granting permissions without thinking, you can give malicious developers access to sensitive data on your smartphone (such as calendar, messaging apps, SMS, files and storage, contacts, call logs, location, microphone and camera). They can even read your screen while you type. With this access, they can:

• Collect the passwords of your most sensitive accounts,
• Capture single-use SMS passwords,
• Register your device to high-priced subscription services,
• Create a picture of your digital life and sell it to advertisers,
• Endanger your physical security by tracking your location,
• Turn your smartphone on to a listening device by turning on the camera/microphone.
• It can encrypt your files and hold them for ransom,
• It can install malware on your device

Artificial intelligence assistant applications pose an increasing permission risk that needs particular attention. Many request always-on microphone access to detect the wake word, as well as access to contacts, calendar, and in some cases, screen content. Treat AI applications with the same rigor as other categories. Health and fitness data is another overlooked risk factor. Apps with access to your health data may share or sell that data in ways that have real-world consequences; This could have implications in areas such as insurance and data brokerage. 

App permissions should be managed securely

·    First of all, only download apps from trusted stores (Google Play/App Store).

·       Read reviews of apps before deciding to download.

·       Install a mobile security solution from a reputable security provider.

·       Before allowing or blocking the app in question, ensure that the app in question is running. Always consider whether permission is required for  

·       Another good rule of thumb is to only use “allow once” or “allow on use”. 

·       Many apps will prompt you to review your permissions regularly. However, it may be a good idea to proactively control permissions.