Are disabled apps vulnerable to malware?

KeysPeak

In other words, does having a bunch of disabled apps increase attack surface compared to not having those apps installed?

EverettHitch

KeysPeak Short answer is no, disabled apps do not run, are basically inactive so can't execute any malicious code.

Novaliss

KeysPeak For this OS, I would say that in general disabled apps are inert. But consider the case where Sandboxed Google Play can be installed, kept disabled, and still satisfy other apps demand for it to be present, disabled doesn't mean totally out of business even though the disabled app cannot do any active work. This far I've never seen any app transgress the disabled state, but I'm just another user.

xxx

EverettHitch disabled apps do not run

They can get enabled very 'easy' (by software/maleware) if I'm not mistaken.

Ignorant_Cormorant

Novaliss Sandboxed Google Play can be installed, kept disabled, and still satisfy other apps demand for it to be present

Do you mind explaining how this would work? An app checks GoogleApiAvailability, gets SERVICE_DISABLED and proceeds to use the non-available APIs?

Novaliss

Ignorant_Cormorant mind explaining how this would work

I'd really wish being able to give you a good answer beyond just having tried myself for many months ago uninstalling Sandboxed Google Play, and then abruptly failing when trying to use, I'm not even sure about the specific app🙂‍↕️, but it might have been BankID, Swish Payments, or Easypark. Re-installing Sandboxed Google Play, without any google login and disabled right away and it all worked again.

EverettHitch

xxx then you should be able to freaking spot that, wouldn't you? But that is not my experience.

xxx

EverettHitch should be able to freaking spot that

Sure. Maybe some developer can tell us more. I'm no expert.

xxx if I'm not mistaken.

Novaliss

xxx can get enabled very 'easy' (by software/maleware

A disabled app cannot get enabled by another 3rd party app.

xxx

Novaliss
Ok. But what about the stores?

Novaliss

xxx the update of a disabled app in most Android OS:es enables the app but not in GrapheneOS which has a specific changed preference to prevent this from happening.

KeysPeak

Some interesting responses here. Sounds like the answer is no, but I am curious how exactly apps are able to use Google Play even if Google Play is disabled. This could mean there are cases where a disabled app (at least Google Play) can increase attack surface, since it would seemingly have more permissions than it would if GP wasn't present.

de0u

KeysPeak I am curious how exactly apps are able to use Google Play even if Google Play is disabled.

I suspect that's not what's happening.

Some apps may verify that Play is installed, but then use Play only for a few app functions. Those apps might be fine with Play installed but disabled until a specific function is invoked, and then might hang or crash. It's even possible that some apps erroneously check that Play is installed and never use it at all, or try to use it but silently ignore the failure.

Having a specific app to look at might help move from speculation to understanding.

Novaliss

KeysPeak able to use Google Play even if Google Play is disabled

I'm kind of confident in Sandboxed Google Play when disabled, won't get used beyond indicated being present. The swedish general DigitalID-app BankID asks for Play Services on app start and notifies about them being disabled. All of the normal features works after just dismissing the prompt.

Enable Google Play services
BankID won't work unless you enable Google Play services.

When I find and obtain my coming Pixel9, I will test again with no Play at all at first, since I cannot remember which ones of my apps;
Rejected functioning until installing Play, no login and disabled, then worked.

But the disabled, non-logged in Sandboxed Google Play were accepted by all of them since obtained a Google account only quite recently. This means that none of them checked deeply for Play installation SourceStamp, since I obviously couldn't use Play to install, just Aurora, Github, Apkupdater, Obtainium, Zapstore, direct APK installs etc.

Having said this, now when using a real logged in Play for most installs, the single app that frankly refuse functioning while Play Services are disabled, is Play Store itself.☺️ (And, Play Integrity API-checker)

bbcbab

Great topic! Quick question, more specific: Can disabled apps be found or interacted with by other apps through ICS, or does being disabled hide them and block any sharing?

Don't need guesswork, opinions or answers to other questions. Just specifically what I asked above.

Novaliss

bbcbab does being disabled hide them and block any sharin

No, I don't see any hiding the applications list out of disabling the apps. The apps that looks for this will see them regardless. E.g. Appmanager
https://github.com/MuntashirAkon/AppManager/releases
declare

android.permission.QUERY_ALL_PACKAGES
android.permission.GET_TASKS
and it can display all the apps on the device, even a few that won't show up in the 'All apps' GrapheneOS settings page, like the Private Space app when that isn't unlocked.

KeysPeak

I'd love to get a response from the GrapheneOS team, particularly about a threat vector that doesn't involve Google Play. When I made this post I was thinking something along the lines of a disabled that that is outdated, a vulnerability in that app is found and somehow executed either from the app (I don't know how that would work), or an active app leverages a vulnerability in the disabled app to escalate privileges or otherwise access a resource it shouldn't have access to.

Not really a technical question but that's the best I've got, I know very little about Android architecture.

My reason for making the question is that I have possibly too many apps in my main profile but quite a lot of them are disabled. I thought maybe pruning them would be wise.

I'm also curious if having an app active in one profile but disabled in another could cause problems. But I think that would be an unlikely threat assuming sandboxing between profiles is secure. Probably beyond the scope of my original question.

Novaliss

KeysPeak executed either from the app

In GrapheneOS, if not tampered with by various Adb commands, Shizuku, Tasker or suchlike, I wouldn't expect this.

KeysPeak or an active app leverages a vulnerability in the disabled app to escalate privileges or otherwise access a resource it shouldn't have access to.

For this I cannot quantify the risk, outside of my scope of understanding. 👩🏾‍💻

KeysPeak love to get a response from the GrapheneOS team