---
title: Tracking Side-loaded Accessibility Services | Guardsquare
description: It's important to consider whether applications are side-loaded when deeming them suspicious. Learn about tracking side-loaded accessibility services.
---

[![guardsquare-logo](https://insights.guardsquare.com/hs-fs/hubfs/Logos/logo-white.png?length=536&name=logo-white.png "guardsquare-logo") ](https://23593082.hs-sites.com/)

- pricing

[Request Pricing](https://www.guardsquare.com/request-pricing?hsCtaTracking=646b0379-d596-4b1a-8526-2ccbdbb0f81b%7Ce8809087-a83f-4476-8b22-34b9572013fd)

[Login](https://customers.guardsquare.com/login?utm_referrer=https%3A%2F%2Fwww.guardsquare.com%2F)

En

- [中文](https://www.guardsquare.com/zh-hans)
- [한국어](https://www.guardsquare.com/ko)
- [Português](https://www.guardsquare.com/pt-br)
- [Español](https://www.guardsquare.com/es)

# [Mobile Application]

# Security Research Center

 Table of contents

# Tracking side-loaded accessibility services

**Guardsquare recommended technique**

|   | **Technique summary** |
| --- | --- |
| **Technique** | Tracking side-loaded accessibility services |
| **Against** | [Malicious accessibility services](https://23593082.hs-sites.com/knowledgebasetest/attacks/a11y-attacks) |
| **Limitations** | API Level ≥ 34 (Android ≥14), requires QUERY_ALL_PACKAGES privilege |
| **Side effects** | This technique may restrict third-party app stores if they are not included in the installer list |
| **Recommendations** | Recommended for use [combined with other techniques for older devices.](https://23593082.hs-sites.com/knowledgebasetest/attacks/a11y-attacks#2) |

This technique is an extension of [accessibility services allow-listing](https://23593082.hs-sites.com/knowledgebasetest/defense/a11y-allowlist).

Yet another criterion for considering applications as suspicious is whether they have enabled accessibility services and they are side-loaded. The implementation is shown in the snippet below:

 private void inspectSideLoadedA11yServices() { AccessibilityManager am =(AccessibilityManager) mContext. getSystemService(Context.ACCESSIBILITY_SERVICE); a11yServiceList = am.getEnabledAccessibilityServiceList(FEEDBACK_ALL_MASK); // (...) for (AccessibilityServiceInfo asi : a11yServiceList) { packageName = asi.getId().split("/")[0]; try { if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) { installer = packageManager. getInstallSourceInfo(packageName). getInstallingPackageName(); } else { installer = packageManager.getInstallerPackageName(packageName); } if (installer == null || !installer.equals("com.android.vending")) { Log.d(TAG, "[!] app '" + packageName + "' has a11y and is side-loaded"); sideLoadedA11yAppList.add(packageName); } } catch(PackageManager.NameNotFoundException e) { } } }

 

## [Guardsquare](https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare)

Connect with the author

** Table of contents **

![HubSpot CMS](https://cdn2.hubspot.net/hubfs/302335/hubspot-cms-logo-gray.svg "HubSpot CMS")

[General Terms](https://23593082.hs-sites.com/terms-of-use) | [Privacy Policy](https://23593082.hs-sites.com/privacy-policy) | [Cookie Policy](https://23593082.hs-sites.com/cookie-policy)

Tervuursevest 362 bus 1, 3000 Leuven, Belgium | VAT: BE0550675829 |

© 2016-2026 Guardsquare nv. All rights reserved.

<https://www.facebook.com/guardsquare> <https://twitter.com/Guardsquare> <https://www.linkedin.com/company/guardsquare/> <https://www.youtube.com/channel/UCP9s5F1ksT1E-7vSF2CDyhw> <https://github.com/Guardsquare>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsquare",
    "url" : "https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare"
  },
  "dateModified" : "2024-02-28T01:52:02.683Z",
  "datePublished" : "2024-02-13T18:14:45.000Z",
  "headline" : "Tracking Side-loaded Accessibility Services | Guardsquare",
  "mainEntityOfPage" : {
    "@id" : "https://23593082.hs-sites.com/knowledgebasetest/defense/a11y-sideloaded",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    }
  }
}
```