Hacker News new | ask | show | jobs
by xg15 1660 days ago
> How can a sandboxed user installed app with limited permissions cause dialing 911 to fail?

No idea about this particular problem, but my takeaway was that Android apps are more similar to web extensions with service workers than to traditional executables.

An app can register itself for all kinds of OS hooks during install. When a hook is triggered, the OS will send an event to the appropriate process of that app. If no process is running, the OS will launch one.

This means there is not a lot of meaningful distinction between "running" and "not running" on Android: As long as the app is installed, the OS may run code from that app at any time.

(This is why you can have half a dozen messenger apps running "in the background" without draining your battery: There is no actual background process for each messenger, just entries in a database somewhere. When a new message comes in, the OS receives a push notification, displays a message to the user styled according to the app's configuration - and might eventually launch a process for the app if the user interacts with the message.)

So it's quite possible that the Teams app registers itself for some kind of "outgoing phone call" hook, and there was a bug in Teams' handling of that.

1 comments

So, this implies that a serious bug in any program with the 'call' hook could prevent your phone from making a call, even 911? Seems like a big deal!

In software I write, the logic for 'emergency' priority events doesn't go through the same call chain for this reason.

Not an Android expert, but this is how it seems to me.

It's Google's responsibility to implement the hooks in a secure way, so that an app that is registered e.g. for the "call" hook cannot prevent the call from taking place.

Seems that somewhere in there, someone messed up.

The issue is that you might have a device where emergency calls have to be routed through a VoIP app, per legal requirements, e.g. if no cellular emergency calling is available (e.g. on voip-enabled wifi-only devices, or on voip-enabled devices in locations without cellular signal))