Ravindra BagaleCourses & study guides

44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi

44.10 Project, Ethics, IT Act and Purple Interview Lines

By Last updated:

Allowed:

  1. Build weak mobile-related target you own (emulator APK or host-only PHP portal)
  2. From Kali host-only, show the weakness
  3. Fix and re-verify
  4. Snapshot / revert

Banned: stalkerware, OTP theft, scanning others' phones, BlueBorne exploit kits against strangers, evil twin in public, "find my partner" spyware.

Ethics: written permission + own lab; IT Act awareness (sections such as 43 and 66 – verify); never touch others' phones; CERT-In / cybercrime.gov.in / 1930 awareness for real fraud.

Interview model (clean English): "I treat phones as full computers with SIM and MFA. In the lab I demonstrate a weak sideload or cleartext mobile-portal token on my own emulator or host-only VM, then enforce store-only installs, permission hygiene, and HTTPS. I do not install stalkerware or test against devices I do not own."

Red team (attacker) does Blue team (defender) detects / stops
Ignores scope; targets classmate phones Written scope; emulator / .50 only
Shares stalkerware "for couples" Refuses; teaches law + consent + IT Act
Leaves weak portal on bridged Wi-Fi Host-only; check ip a before demo

Ravindra Bagale's Tip

"Just one check of my girlfriend's phone" = illegal + the end of your career. CEH exam modules also put authorization first. Use your own emulator. Remember this.

Lab

Pair ethics drill: one builds weak portal / emulator APK; other only tests the agreed IP or AVD. Both write 4-line IT Act + no-stalkerware reminder. Switch.

Project: Build it, hack it, fix it

Build: For fictional Raja-Rani Traders (Pune sales team on Android): pick Path A or Path B. Path A (preferred server-side): On YOUR host-only VM 192.168.56.50 (Amazon Linux / Ubuntu), create a tiny PHP "mobile login / field token" portal that (1) serves over plain HTTP, (2) stores a session token or API key in a world-readable file under /var/www/html/mobile/token.txt or echoes it in an HTML comment, (3) accepts password admin / admin for user rani, (4) sudo yum install httpd php then sudo service httpd start (Ubuntu: apt + sudo service apache2 start), firewalld off or wide open for lab. Snapshot pre-weak-mobile. Path B (emulator): Build or download a deliberate lab-only demo APK (your code) that stores a bearer token in cleartext shared preferences / a world-readable file; sideload only into YOUR Android emulator / wiped test phone – never into a staff production phone. Hack (lab only): From Kali 192.168.56.10, nmap -sS -T2 -p 80,443 192.168.56.50; curl -s http://192.168.56.50/mobile/login.php and fetch token.txt or scrape the HTML comment; prove token replay with curl -H 'Authorization: Bearer ...'. For Path B, use adb on your emulator to pull the cleartext token file (lab). Never evil-twin the public, never BlueBorne-exploit classmates, never stalkerware. Fix: Move portal to HTTPS (self-signed OK in lab); delete cleartext token files; store secrets server-side with proper sessions (Secure / HttpOnly cookies from Chapter 41 ideas); strong password + rate limit; sudo service httpd restart after config test; firewalld allow port 443 only from 192.168.56.10; on Android path – stop sideload, use debug build only inside emulator, encrypt prefs / use Android Keystore concepts, revoke excess permissions. Re-verify: cleartext token.txt gone; HTTP login disabled or redirects; Kali without allow-list cannot scrape secrets; emulator app no longer writes world-readable tokens. Purple note: Red proved mobile-related cleartext tokens and sideload habits are enough for account abuse; Blue proved store/HTTPS/permission/MDM thinking without touching anyone else's phone.

Thodkyaat sangaycha tar

  • Mobile threat model: lost/stolen, malware, phishing/OTP, rogue apps, bad Wi-Fi, rare targeted spyware.
  • Android: permissions, Play Protect concepts, no casual sideloading; patch or retire EOL devices (Stagefright lesson).
  • iOS: App Store + sandbox defaults; Apple ID MFA; Lockdown Mode awareness for elevated risk.
  • Compromise signs = checklist (unknown apps, Accessibility, weird VPN/profile, account alerts) – not one slow battery.
  • Cleanup: change passwords / revoke sessions from a clean device first; factory reset later; bank / CERT awareness.
  • MDM / BYOD for Sahyadri-class SMEs – lost-phone wipe and offboarding matter.
  • Bluetooth: pairing hygiene; BlueBorne (2017) = patch awareness, no exploit recipes.
  • Phone Wi-Fi: evil twin / captive portal caution; HTTPS + VPN on untrusted nets; own lab only.
  • Hardening: lock, encryption at rest, updates, permission hygiene, MFA.
  • Ethics / IT Act: never others' phones, no stalkerware, no OTP theft; Project Build-Hack-Fix for Raja-Rani on OWN .50 / emulator.

Samjla ka? Mobile device security shiklo – pan pratyek sobat bachav, own lab, ani ethics. Content chapters ithe strong base; pudhe **exercises, interview practice, ani CEH exam modules** revision / retrofit – still ethics-first. Chala revise kara, mitrano!