Android › Module 2 › Lesson 1
Dangerous Permissions to Avoid
Accessibility, SMS, notification access, and other permissions malware loves
Opening
Allow once, regret for months
Android’s permission model is strong when you use it. Attackers win when users tap Allow on services that can see everything—Accessibility, notification access, SMS, call logs, or device admin. Learn which grants are radioactive.
1. High-Risk Permissions
Accessibility
Can read screens and click for you. Essential for some assistive apps; abused by banking malware.
Notification access
Can see OTP and 2FA codes that arrive as notifications.
SMS / Call logs
Intercepts banking OTPs and private conversations.
Device admin / Device owner hooks
Makes uninstall hard; used by ransomware-style lockers and aggressive spyware.
Draw over other apps / Appear on top
Classic overlay phishing on top of real apps.
2. Reasonable vs Suspicious
A camera app wanting Camera is normal. A wallpaper app wanting SMS is not. A password manager may need Autofill. A random cleaner does not need Accessibility. When unsure: Deny, use the app without that feature, or uninstall. You can grant later from Settings if needed.
Audit monthly
Settings → Apps → Special app access (Accessibility, Notification access, Device admin). Remove anything unfamiliar.
Knowledge Check
Why is Accessibility permission dangerous in the wrong hands?
Multiple choice
Knowledge Check
True or False: Notification access can expose one-time passwords shown in alerts.
True or False
Knowledge Check
Which request is most suspicious?
Multiple choice