Suspicious, we were, that Little Weed was burning through our internet bandwidth quota very quickly. Even with wifi off, how could this happen? Some Android apps have the ability to turn on wifi by themselves and communicate.
Little Weed noticed that one of his apps, Head Soccer, updated without his knowledge, so he asked to take the phone off our wifi network. This app, Head Soccer, has following permissions:
Version 5.1.2 can access:
In-app purchases
Photos/Media/Files
modify or delete the contents of your USB storage
read the contents of your USB storage
Storage
modify or delete the contents of your USB storage
read the contents of your USB storage
Wi-Fi connection information
view Wi-Fi connections
Other
full network access
Google Play license check
prevent device from sleeping
view network connections
With permission for “Network Communication – full internet access”, it is able to turn wifi on by itself and download at will. This is a security risk.
This is a fairly common request and often involves and application simply retrieving updates online, and can include widgets, web browsers, social networking software and more. However, this is also an essential permission for malware designed to transfer data off a phone, so should be viewed with some caution.
source
Once the owner has turned off wifi, no app should be able to turn wifi on by itself and talk to the internet. No app should have the ability to override the wishes of its owner.
We have changed the wifi passwords on his phone and will be more careful in the future.
