<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-mobile-app-permissions
description: >-
  Analyze Android and iOS application permission requests for over-privilege,
  dangerous permission combinations, runtime permission handling, and compliance
  with least-privilege principles per OWASP MASVS.
domain: cybersecurity
subdomain: mobile-security
tags:
  - permissions
  - android-permissions
  - ios-entitlements
  - least-privilege
  - privacy
  - owasp-masvs
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1422", "T1430"]
  owasp-mobile: ["M1", "M6"]
  tools: ["androguard", "apktool", "aapt", "codesign", "ldid"]
---

# Auditing Mobile App Permissions

## Overview

Permission auditing identifies over-privileged applications requesting unnecessary
access to sensitive device capabilities (camera, microphone, location, contacts,
SMS). Evaluates whether permissions align with stated app functionality and flags
dangerous combinations indicative of spyware or data harvesting.

## Prerequisites

```bash
pip install androguard
apt install aapt         # Android Asset Packaging Tool
# For iOS: codesign, ldid, or manual entitlements extraction
```

## Workflow

### Step 1: Extract Android Permissions

```bash
# Using aapt
aapt dump permissions target.apk

# Using androguard
androguard permissions target.apk

# From decompiled manifest
grep 'uses-permission' apktool_out/AndroidManifest.xml

# Custom permissions defined by the app
grep 'permission android:name' apktool_out/AndroidManifest.xml
```

### Step 2: Classify Permission Risk

```
DANGEROUS PERMISSIONS (require runtime approval):
├── CAMERA                    — Photo/video capture
├── RECORD_AUDIO              — Microphone access
├── ACCESS_FINE_LOCATION      — GPS location
├── ACCESS_COARSE_LOCATION    — Network location
├── READ_CONTACTS             — Contact list access
├── READ_CALL_LOG             — Call history
├── READ_SMS / RECEIVE_SMS    — SMS access
├── READ_PHONE_STATE          — Device identifiers
├── BODY_SENSORS              — Health sensors
├── READ_EXTERNAL_STORAGE     — File access (pre-13)
└── READ_MEDIA_IMAGES/VIDEO   — Media access (13+)

SPECIAL PERMISSIONS (require settings toggle):
├── SYSTEM_ALERT_WINDOW       — Draw over apps (overlay attacks)
├── BIND_ACCESSIBILITY_SERVICE — Accessibility (keylogging risk)
├── BIND_DEVICE_ADMIN         — Device admin (wipe, lock)
├── REQUEST_INSTALL_PACKAGES  — Sideload APKs
└── MANAGE_EXTERNAL_STORAGE   — All files access

SUSPICIOUS COMBINATIONS:
├── CAMERA + RECORD_AUDIO + LOCATION = Surveillance
├── READ_SMS + SEND_SMS + INTERNET = SMS stealer
├── ACCESSIBILITY + OVERLAY = Credential harvester
└── DEVICE_ADMIN + OVERLAY = Ransomware
```

### Step 3: Extract iOS Entitlements and Privacy Keys

```bash
# Extract entitlements from IPA
unzip target.ipa -d extracted/
codesign -d --entitlements - extracted/Payload/App.app

# Or with ldid
ldid -e extracted/Payload/App.app/AppBinary

# Check Info.plist privacy usage descriptions
plutil -convert xml1 extracted/Payload/App.app/Info.plist
grep -E 'NSCamera|NSMicrophone|NSLocation|NSContacts|NSCalendars|NSPhoto' \
  extracted/Payload/App.app/Info.plist

# Verify usage descriptions exist for all privacy keys
# Missing descriptions = App Store rejection + privacy violation
```

### Step 4: Runtime Permission Analysis

```bash
# Frida: Monitor permission requests at runtime
frida -U -f com.target.app -l perm_monitor.js --no-pause
```

```javascript
// Monitor Android runtime permission checks
Java.perform(function() {
    var ContextCompat = Java.use('androidx.core.content.ContextCompat');
    ContextCompat.checkSelfPermission.implementation = function(ctx, perm) {
        var result = this.checkSelfPermission(ctx, perm);
        console.log('[PERM CHECK] ' + perm + ' = ' +
            (result === 0 ? 'GRANTED' : 'DENIED'));
        return result;
    };

    var ActivityCompat = Java.use('androidx.core.app.ActivityCompat');
    ActivityCompat.requestPermissions.implementation = function(act, perms, code) {
        console.log('[PERM REQUEST] ' + perms.toString());
        return this.requestPermissions(act, perms, code);
    };
});
```

### Step 5: Compliance Assessment

```
MASVS-PRIVACY Permission Checklist:
├── [ ] Only permissions necessary for core functionality requested
├── [ ] Dangerous permissions requested at point of use (not on install)
├── [ ] Usage descriptions accurate and specific (iOS)
├── [ ] Graceful degradation when permissions denied
├── [ ] No permissions retained after feature disabled
├── [ ] Scoped storage used instead of broad file access (Android 11+)
├── [ ] Approximate location used where fine location unnecessary
└── [ ] Background location justified and disclosed
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Over-privilege | Manifest | Permissions exceeding app function |
| Dangerous combos | Manifest | Surveillance permission sets |
| Missing descriptions | Info.plist | Privacy keys without usage strings |
| Background access | Manifest | Background location/sensors |

```yaml
title: Auditing Mobile App Permissions Detection
id: ffb68d0d-4029-456e-8b90-c4b158815212
status: experimental
description: Detects suspicious activity related to auditing mobile app permissions techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1422
  - attack.t1430
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] All permissions extracted and classified
- [ ] Dangerous permissions justified against app functionality
- [ ] Suspicious combinations flagged
- [ ] iOS privacy usage descriptions validated
- [ ] Runtime permission flow tested
- [ ] Least-privilege compliance assessed

## References

- [OWASP MASTG — Permission Testing](https://mas.owasp.org/MASTG/)
- [Android Permissions](https://developer.android.com/reference/android/Manifest.permission)
- [iOS Privacy Keys](https://developer.apple.com/documentation/bundleresources/information_property_list)
- [MITRE T1422](https://attack.mitre.org/techniques/T1422/)
