Required to be able to access the camera device.Īllows an application to read the user's contacts data.Ī_COARSE_LOCATIONĪllows an app to access approximate location.Īllows an app to access precise location.Ī_EXTERNAL_STORAGEĪllows an application to write to external storage.Ĭom.RECEIVEĬom._EVENTĪllows an application to read from external storage.Ĭom.BIND_GET_INSTALL_REFERRER_SERVICE ( Show technique in the MITRE ATT&CK™ matrix)Īllows applications to access information about networks.Īllows applications to access information about Wi-Fi networks.Īllows applications to open network sockets.Īllows applications to read the sync settings.Īllows applications to read the sync stats.Ī_BOOT_COMPLETEDĪllows an application to receive the ACTION_BOOT_COMPLETED that is broadcast after the system finishes booting.Īllows using PowerManager WakeLocks to keep processor from sleeping or screen from dimming.Īllows applications to write the sync settings.Ĭom._SHORTCUTĪllows an application to install a shortcut in Launcher.Īllows an app to use fingerprint hardware.Īllows an application to read the user's calendar data. Pattern match: match: match: match: match: match: match: match: match: match: match: match: match: match: match: match: match: String relevance 3/10 ATT&CK ID

Has the ability to execute code after rebootĪn adversary could use a malicious or exploited application to surreptitiously record activities using the device microphone and/or camera through use of standard operating system APIs.Īdversaries may target user email to collect sensitive information from a target.įound a potential E-Mail address in binary/memory An Android application can listen for the BOOT_COMPLETED broadcast, ensuring that the app's functionality will be activated every time the device starts up without having to wait for the device user to manually start the app.

Evernotecom