com.sec.modem.settings Copy

Labelled "SilentLogging" on Galaxy devices, this is a Samsung-signed system package with no launcher entry: this site records it as not user-facing on every observation, and the key that signs it also signs the Android framework. The package name places it on the modem side of Samsung's telephony stack, and the permissions it declares are consistent with modem diagnostic logging rather than with an app a user ever opens. What can be established is the declared permission set recorded here: android.permission.BIND_TELEPHONY_NETWORK_SERVICE, which the Android platform manifest defines as a permission a NetworkService must require so that only the system can bind to it, at signature protection level; a Qualcomm-namespaced permission, com.qualcomm.permission.QCOM_DIAG, whose semantics Qualcomm does not publish and which is not defined in the AOSP platform manifest; com.sec.phone.permission.SEC_FACTORY_PHONE, a permission in the namespace of com.sec.phone, documented alongside this entry; and READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE, POST_NOTIFICATIONS and RECEIVE_BOOT_COMPLETED. Two absences in that record are worth stating plainly, because this package attracts a good deal of inaccurate description elsewhere. The permissions aggregated here include no android.permission.INTERNET, and no READ_SMS, READ_CALL_LOG or READ_PHONE_STATE. Samsung publishes no functional documentation for the package, and descriptions circulating on APK catalogues and advertising-funded "what is this app" sites are not a basis for a claim, so this note does not repeat the widely reproduced assertion that it uploads call or message logs to Samsung servers. That claim is unsourced, and the declared permission set recorded on this site does not support it. Version note. Samsung's own Common Criteria application lists record it at 1.0.1 on Android 9-era Galaxy S10+ firmware and again at 1.0.1 on both Android 11-era lists examined here, the Galaxy S20 FE and the Galaxy S20 Ultra, and 1.0.1 is also both the oldest and the newest build recorded on this site. The version string has therefore not moved across any of those data points and is uninformative for judging what a device is running. The target SDK does move, from 29 to 36 across observations here, and the package is seen from API 28 through API 37. No change of role across Android releases could be sourced. For Android Enterprise, EMM and kiosk use, being non-user-facing means administrators normally meet it in an EMM app inventory rather than on a device, which is usually the whole of the encounter. The permission set recorded here contains no direct SMS, call-log or phone-state permission, which is worth knowing when assessing it; it does not on its own establish that the package has no other route to that content, since a platform-signed component may reach data through privileged IPC or through proprietary permissions whose semantics Samsung does not publish. Samsung documents neither what depends on it nor what its absence would affect on the modem side, so disabling is rated caution rather than treated as a routine debloat target.

• core/res/AndroidManifest.xml (android.permission.BIND_TELEPHONY_NETWORK_SERVICE) - Android platform source →
• Galaxy S10+ LTE (G975F) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 FE 5G (G781B) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 Ultra 5G (G988W) application list - Samsung Knox CC Mode documentation →
• Package provenance for com.sec.modem.settings - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 20 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 10 permissions: 3 runtime (user-granted), 1 signature or system-level, 3 install-time and 3 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.