When installing the Android application and analyzing the AndroidManifest.xml file, it was found that the application requests access to more permissions than what was expected. Specifically, the application requests the following unnecessary/dangerous permissions: ```xml

``` The most intrusive permissions are the following: - **android.permission.SYSTEM_ALERT_WINDOW:** Allows an application to show system-alert windows. Applications can force themselves to the front without your control. - **android.permission.CAMERA:** Allows applications to take pictures and videos with the camera at all times. - **android.permission.GET_TASKS:** Allows applications to retrieve information about the currently and recently running tasks. May allow applications to discover private information about other applications. - **android.permission.READ_PHONE_STATE:** Allows applications to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on. - **android.permission.WRITE/READ_EXTERNAL_STORAGE:** Allows applications to read and write to the external storage. - **android.permission.READ_MEDIA_IMAGES/VIDEO/AUDIO:** Allows applications to read image/video/audio files from external storage. - **android.permission.RECORD_AUDIO:** Allows applications to access the audio record path. - **android.permission.ACCESS_COARSE_LOCATION:** Allows coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Applications can use this to determine where you are and may consume additional battery power - **android.permission.WRITE_SETTINGS:** Applications can modify the system's settings data, potentially corrupting it. - **android.permission.BLUETOOTH_CONNECT:** Applications can read and pair to Bluetooth devices

	Low	Medium	High	Critical	Total
Not fixed	3	3	-	-	6
Acknowledged	-	-	-	-	0
Fixed	2	1	1	-	4
Total	5	4	1	0	10

Websea Exchange

Summary

Issues (10)

Application Requests Excessive Permissionsnot_fixed/medium

Intrusive Mobile Application Analyticsnot_fixed/medium

Persistent Sensitive Information in Memory Afternot_fixed/medium

Cookies Missing Security Flagsnot_fixed/low

Lack of SSL Pinningnot_fixed/low

Contract (1)