PhoneAccount Abuse Detector
 

Simple application to enumerate and detect any application that (ab)uses adding an indefinite amount of PhoneAccount(s) to Android's TelecomManager. As seen on Android Police, XDA-Developers, Xataka Android.

Background

This application exists because malicious or just improperly programmed applications can, intentionally or not, block your device from the ability to call emergency numbers. If you are in such a situation, this app helps you to find the culprit – which you then can uninstall (or disable).

For the exact details on the vulnerability (why this happens, how it was discovered, fixes timeline, ...), please check the article by Mishaal Rahman here.

About permissions

This application requires two call management permissions, Manifest.permission.READ_PHONE_STATE and Manifest.permission.READ_PHONE_NUMBERS.

READ_PHONE_STATE is used in all supported Android versions, whereas READ_PHONE_NUMBERS is requested on Android 12 and onwards exclusively. This is because on Android, in order to read which applications are adding PhoneAccounts to Android's TelecomManager, these permissions are necessary.

No permission is (ab)used to log, collect or process any personally identifiable user information.

Download

Click here to download the latest version

Application usage

The application is very simple, and contains 2 components:

• A message at the top of the device, explaining if the application detected a possible abuse of this functionality which may cause issues while attempting to call Emergency Services.
• A list of the applications that have registered a Phone Account in your device, usually including your own SIM Cards, Google Duo, Teams, among others. Alongside each app, the number of accounts is displayed to facilitate the identification of the malfunctioning/hijacking application.

Check this video if you have doubts on how to interpret this data:

(Thanks to Explaining Android for the video)

Screenshots

Permissions necessary for the app to work

Case where Teams added 380 PhoneAccounts to TelecomManager
The app flags this as abnormal behaviour

Case without any abnormal app behaviour