Android permission to limit INSTALL_REFERRER to play store

Issue

I'm setting up campaign tracking using custom analytics (not google analytics) and setting up a receiver for that. My receiver seems to be working, but when I install I get an android lint warning:

ExportedReceiver: Receiver does not require permission

It looks like any old android app could call my application with the com.android.vending.INSTALL_REFERRER intent which I do not want. It should only be the Google Play Store (or any other android system application that would install my app from the play store) sending that intent to my application.

So I've tried to figure out how to set up a permission that limits the valid applications to the play store, but I can't figure out the correct way to set up the permission according to the documentation:

https://developer.android.com/guide/topics/manifest/permission-element.html

Could someone help me setup a permission that limits the applications my application will accept this intent from to the play store? Here's my current receiver config:

    <receiver
            android:name=".referrals.MyCampaignTrackingReceiver"
            android:enabled="true"
            android:exported="true">
        <intent-filter>
            <action android:name="com.android.vending.INSTALL_REFERRER"/>
        </intent-filter>
    </receiver>

I tried setting a permission for the receiver at the normal level but that prevented the app from receiving the intent from the playstore.

Solution

INSTALL_REFERRER broadcast permission is not a great concern. Assuming you know you need to handle this broadcast only once, right after install, and you take measures to handle it only once, an attacker will have to know when your app has been installed and somehow send this broadcast before the playstore app, which seems unlikely.

Answered By - Yoni Gross