Apps Fake permissions and unauthorized operations

[queensoft]

I do a lot of Android app testing. I use my regular phone, where I have my contacts and my regular gmail account. I never used a credit card on this account.
I mostly use APK files to install the apps.
I have 2 questions:
1. can an app display some permissions when installing, but have others hidden permissions ?
Example: instal APK file > says permissions "Network access" and that's it.
Can this app also read my data or make phone calls, even though those permissions were not displayed ?
What is I use an app to display ALL permissions ? Can it really display all or is there an way to still have hidden permissions ?
I use Android 2.3.7 root and 4.1 no root.
2. Can an app make unauthorized hidden operations, like place phone calls or send texts or steal my gmail password ?
Like I said, I never used a credit card, so at least that's not a problem.
But I have my SIM card - can an app place a value added call or SMS (I don't know the exact English term - expensive call), without me knowing about it ?
Or compromise my Gmail account ? I have an alternate email for recovery.
Thanks for your help.

 

[kman9637]

I do a lot of Android app testing. I use my regular phone, where I have my contacts and my regular gmail account. I never used a credit card on this account.
I mostly use APK files to install the apps.
I have 2 questions:
1. can an app display some permissions when installing, but have others hidden permissions ?
Example: instal APK file > says permissions "Network access" and that's it.
Can this app also read my data or make phone calls, even though those permissions were not displayed ?
What is I use an app to display ALL permissions ? Can it really display all or is there an way to still have hidden permissions ?
I use Android 2.3.7 root and 4.1 no root.
2. Can an app make unauthorized hidden operations, like place phone calls or send texts or steal my gmail password ?
Like I said, I never used a credit card, so at least that's not a problem.
But I have my SIM card - can an app place a value added call or SMS (I don't know the exact English term - expensive call), without me knowing about it ?
Or compromise my Gmail account ? I have an alternate email for recovery.
Thanks for your help.

1. I've never heard of this happening, but some require you to click see all when installing.

2.If you install from the play store, most probably not.

If you are as concerned with security as I am, I strongly recommend Avast Mobile. Cheers.