Source
r/androiddev•
RayTheGrey

Is there a way to intercept SMS messages sent by apps?

Hello everyone. I'm not sure where to turn to, but for the past couple months i keep getting charged in my bill for SMS messages abroad that i never sent. Looking at the detailed bill they get sent to random numbers in France, Morroco and other random countries. They never show up in my SMS app.

Looking at the permissions, no app other than the default SMS app should be able to send messages. I am completely lost on how to stop this or how to even begin looking for whats sending them.

Posted Dec 29, 2020, 5:48 AM UTC

311
s3c-7ech•

Hello, I suggest using ADB to revoke the android.permission.SEND_SMS permission to all the Apps, including system Apps.

You can use the script bellow:

adb shell

for package in $(pm list packages -e | cut -f2 -d":"); do pm revoke $package android.permission.SEND_SMS; done

-e will list all enabled Apps (including system Apps).Another solution is to use AMDH (Android Mobile Device Hardening) which will scan all the applications installed on the phone an detect which ones are harmful and it will backup your SMS database then you can check if there is any suspicious SMS. Note that the SMS database can contains information that are not shown in SMS App.

Hope it help!

1
RayTheGreyOP•

AMDH seems like exactly the utility i need, however i cant seem to get it to do anything other than output the help message.

1
s3c-7ech•

you can use it with:

- option "-sA -t e" to scan all enabled applications (including system apps) without revoking permissions

- option "-sA -t 3 -R" that will revoke dangerous permissions for all the third party apps (application that the user installed)

In both cases a JSON report will be generated with the ID of the device you are using.

- option "-S snapshot_dir" will backup the phone (SMS, contacts, Apps, settings...), in the output folder (specified in the argument -S) will contain a JSON file with all the information from the phone.

please let me know if you need more information!

1
RayTheGreyOP•

I seem to have something misconfigured with my python or android studio instalation. I will try tomorrow.

1
s3c-7ech•

Which operating system are you using ?

1
dj_chapz•

Firstly uninstall any apps that you don't absolutely need to make sure you didn't install something shady that might do something in the background. Then you can go to the remaining apps and check their settings, there should be a list of permissions they have. Check if any non-system apps have the permission to send SMS - that might be the clue.

If nothing helps you can reset your phone to maybe clear any malware that you might have caught. I can't really help you much without knowing which phone and Android version you got. If it's some low budget phone from some smaller company it might be preinstalled malware in the OS, you can't really tell.

0
RayTheGreyOP•

Its a Samsung Note 9 with the latest security updates.

I thought that if an app doesnt have permission to send SMS it shouldnt be able to? And only the preinstalled samsung app for messages has the permission.

Ill try to uninstall everything though. Resetting my phone would be a very big hassle, but might be nessecary.

1
Evakotius•

Only the default SMS app (selected by the user in system settings) is able to write to the SMS Provider.

1
s3c-7ech•

All the applications with granted permissions: android.permission.SEND_SMS and android.permission.WRITE_SMS can send an SMS without user interaction.

1