Can APK's installed from unknown sources without special permission be considered safe?

Question

If i choose to install downloaded APK files from unknown sources, can it log keystrokes or install malware without additional permissions?

Currently users don't have to grant internet permissions when installing apps. For example if you download Soundcloud or Spotify from the Google playstore, you won't be asked to grant the application internet access.

Is internet access only enough to be infected? I don't care if the app is unstable, or use a lot of resources as long as privacy isn't an issue here.

Answer 1

Unless the app is a keyboard type app that you explicitly use for text entry it is highly unlikely to be able to log your keystrokes. There have been proof of concept apps where legitimate keyboard apps have been reverse engineered to do this and distributed as 'cracked' copies from non play store sources.

https://m.theregister.co.uk/2013/03/25/android_security_omnishambles/

Depending on your precise device model there may be unpatched vulnerabilities that could be exploited by any app regardless of permissions. The latest nexus phones are usually well patched...everyone else...well support is patchy.

https://www.google.co.uk/amp/www.androidauthority.com/android-oem-update-speed-743073/amp/

In theory an app with internet permissions could download an install an additional malicious payload, but it couldn't access anything the original app couldn't.

There have been many many examples of malware passing initial play store vetting, but at least it gets removed after complaints.

Amazon offers an alternate app store and they are probably about as trustworthy google. From any other source, if it seems to good to be true, it probably is.

Answer 2

An app that maliciously exploits some system vulnerability may be extremely dangerous, and does not need "suspicious" permissions.

Apps that you download from the official Play Store undergo some (undocumented) verification process which includes anti-virus scan, but most importantly are banned as soon as some malicious activity is detected by Google or other organizations that specialize in monitoring such threats. This does not mean that you can be sure that an app that you install from Play Store will do no harm, but the risk is significantly higher outside.

I would recommend to have an anti-virus app if you need a sideloaded app which you cannot trust, and if you can, use such app on a secondary device that does not hold your vital data.

Also, Android is constantly upgraded to fix many vulnerabilities, therefore latest system may be safer. If you can, use the latest system.

Use Google's Verify Apps which is part of the Play Services. It can identify some harmful apps. This means that it is worthwhile to use a device with Google Services installed and up-to-date.