While reversing some malware, I have realized that despite they use an exploit that gives them root access, such malware declares a lot of permissions in the manifest.
Because (AFAIK) "normal" apps that require the su executable they still need to declare the permissions in the manifest, because the su command just launches a child process with elevated (root, in this case) access.
Android malware reversing isn't my full-time job, but in my little experience this is the most common pattern among malicious apps:
- exploit -> root access
- change permission or remount partition
- steal data from other apps
Thus, my question is:
is possible to invoke an Android API (more precisely, the Java API framework) without declaring the related permissions but with root access?
I guess the answer is yes, but I think it's a twisted process, so it's easier to declare a lot of permissions (but it sticks out like a sore thumb).