privacy - Can the RECEIVE_SMS permission be used to intercept SMS messages?

I've noticed quite a few apps requesting the RECEIVE_SMS permission. Two things are clear to me here:

• RECEIVE_SMS enables an app to "snap" incoming SMS


• READ_SMS just applies to SMS already stored

As some of the apps just were asking for RECEIVE_SMS, but not for READ_SMS, I got curious: this seems to imply RECEIVE_SMS is not only targeted at the receiving part, but the app can also do what it wants with the received message – e.g. read it, then throw it away silently (so the user doesn't even notice there was an SMS – which might be the way TAN Trojans act to snap identifiers for online banking transactions).

But would it also be possible for such an app to "intercept" the message, i.e. receive it, read it (and process its content in any way, e.g. forwarding it by other means such as via IP), and then pass it on as if nothing had happened? In other words: Can it spy on the user this way?

Answer

Yes, it can, but only on Android 4.3 and lower. This is used for example in Whatsapp. When you activate the app, Whatsapp sends an SMS to the number you reported, and the app intercepts it quietly and reports to the servers that it has received the SMS. This is how the account is tied to your number.

Of course, this can be used in harmful apps also. If an app registers as an SMS receiver with the highest priority, the app can listen for incoming SMSs, process them and either dismiss them without the user ever noticing, or forward to the next SMS listener with the second-highest priority.

This has been redone in Android 4.4, and if I understood correctly, only the default SMS app has access to all incoming SMS (SMS_DELIVER_ACTION), and the other apps with correct permissions will only receive a notification of the incoming message (SMS_RECEIVED_ACTION). In addition, the SMS_RECEIVED intent is non-abortable, it can't be stopped. I assume that in Android 4.4, this is done to allow the user to see all incoming SMS messages in the default app.

Edit: Found some more useful info on the Android Developers Blog. I'd test this further, but my only Android phone is currently WiFi-only, so no SMS :/