How to secure install untrusted app I need to use of Google Play Store app for my project. This app is prepared by unknown to me Chinese GPS devices' manufacturer and I want to use it to communicate with device.

App is published on Google Play Store but uses old type of privileges. With installation I would agree to share "Device &amp; app history", "Contacts", "Location", "Phone", "Photos/Media/Files", "Camera", "Microphone", "Device ID &amp; call information" and more.

I don't feel comfortable to share all that data with unknown to me manufacturer and with untrusted app (1 star in shop), but I need to use this app (because it connects to my physical device).

Is there secure way to install that app? Can I be sure that for example app won't copy all my contacts to some shady server? (I can't block network for app, because that would also block communication).

How can I mitigate some risks or limit app capabilities? Should I be aware of some other risks (like app accessing Android Pay)?

I have OnePlus 3 with Android Oreo (stock but in open beta).
Available approaches differ depending on multiple criteria:


Are you using a custom ROM such as LineageOS? It might ship with tools for that. LineageOS e.g. includes Privacy Guard, which let's you restrict apps pretty well.
Is your device rooted? Then you could use tools like LBE to achieve the same – which unfortunately is proprietary, so you cannot really say what goes on behind the scenes.
Is your device rooted and has the Xposed Framework installed? Depending on your Android version, this might hold some power here. For example XPrivacy – which unfortunately is no longer maintained and not compatible with Android 7+


What's left if your answer is "No" to all above? What ships with "stock Android" doesn't really let you control much. For example, all permissions marked as "normal" can't be regulated – which e.g. includes network access. So to really limit an app here, you'd need to modify the .apk file before installing it. So called APK Rebuilder¹ can do that. Basically, they let you mark which permissions you do not want the app to have, and remove them from the Manifest declaration. That way the app doesn't get them granted. It might then crash when trying to access related functionality – or even might not work at all if you removed too much. So general advice is first remove as much as you think useful – and if things go wrong, make a second, less restrictive build. Continue until it works for you – or drop the app and find an alternative.

Another approach is using a "manager" that sandboxes things. One such is Parallel Space (see this answer for details²). But that approach always has another draw-back: such a manager app requires almost all permissions available, as it needs to manage them for the apps you want to restrict. Which requires a lot of trust – and such manager app better be open source (AFAIR the one I saw was not) so it can be checked by as many eyes as possible.



¹ disclosure: link goes to my Android site
² and thanks to Morrison Chang for helping my brain with the name!