Hacker News Reader

Fwiw, this would fail Android's Compatibility Test Suite:

Not necessarily. There are various ways to conceal a listening service, for example through knocking protocol.

If you're implementing a knocking protocol, you probably know enough to change the default password.