com.mediatek.gbaservice Copy

A MediaTek telephony component preinstalled on MediaTek-based devices. It has no launcher entry, no observation here is user-facing, and none is Play-eligible, so it is firmware plumbing rather than an app anyone opens. This site records no friendly label for it at all: every observation carries the package name itself in place of a label. GBA is the Generic Bootstrapping Architecture, standardised by 3GPP in TS 33.220, "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA)", a specification first planned for Release 6 and still under change control. Its purpose is to reuse the authentication credentials already on the SIM to establish a shared secret between the device and a network element, so that an operator service can authenticate a subscriber without a separate username and password. Android has a matching extension point: AOSP defines android.telephony.gba.GbaService, a system API base class that a vendor implementation extends. The class documentation states that a vendor GBA service handles the bootstrap authentication request and reports keys available or an authentication failure back to the caller, and that the implementation declares the BIND_GBA_SERVICE permission, filters the android.telephony.gba.GbaService intent action, and is direct boot aware. Whether this particular package is that implementation on a given firmware is not documented. MediaTek publishes no manifest or documentation for it, and descriptions on APK catalogues are not a basis for a claim. What can be said is that the name sits in the chipset vendor's namespace, matches the standardised term exactly, and appears alongside MediaTek's other telephony components already documented here, such as com.mediatek.ims. Treat the precise role as vendor-defined and firmware-specific rather than an established fact. Provenance repeats the pattern this site records for MediaTek components. The same package name appears across 36 device models from 19 makes, among them Xiaomi, Samsung, Motorola, OPPO, vivo, TCL, Lenovo, Nothing, Infinix, OUKITEL, Ulefone, Unihertz, Newland, CUBOT and NUU, under 14 distinct signing certificates, each classified here as the device maker's own key and each recorded as also signing the Android framework. Builds run from roughly 16.8 KB to 49.7 KB. The aggregated permission set holds a single entry, ACCESS_NETWORK_STATE, which the platform describes as allowing an app to view information about network connections; this site aggregates permissions across observations rather than per build, so which builds request it cannot be established here. Version note. Observations here run from API 31 to API 36, the target SDK roll-up reports 34 to 36, and version names run from 14 to 16. Those are independent roll-ups rather than a per-build pairing, so they cannot be read as saying which target SDK any given device carries. The AOSP GbaService interface is present in current AOSP as a system API, but the release in which it was introduced, and whether this MediaTek package implements that interface or predates it, could not be sourced. Nothing sourced indicates the package has been superseded, replaced or modularised at a particular Android release, so that too is flagged here as an open question rather than answered. For Android Enterprise, EMM and kiosk use it has no enrolment or management role and presents nothing to a user, so an administrator normally meets it in an app inventory. On a Wi-Fi-only device with no SIM there is nothing for SIM-based bootstrapping to do, but there is equally no benefit in removing it. On cellular devices the prudent assumption is that disabling it affects operator services that authenticate using SIM credentials, though what actually breaks could not be sourced, so it is best left in place and only touched with careful per-device testing that includes the carrier services in use on the fleet.

• 3GPP TS 33.220 - Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) →
• android.telephony.gba.GbaService - Android (frameworks/base) source →
• Package provenance for com.mediatek.gbaservice - Android System App Database →

• Re-signed by each device maker with its own platform key - 14 different certificates appear across 10 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 1 permissions: 1 install-time.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.