44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.2 Android Security Model – Permissions, Play Protect, Sideloading
Android = apps in sandboxes; permissions (camera, SMS, accessibility, storage) gate sensitive APIs. User grant = trust decision.
Blue hardening habits (SME staff phones):
- Install from Google Play (or company MDM store) – not random Telegram APK
- Review Play Protect status; do not ignore "harmful app" warnings
- Turn off "Install unknown apps" except for one IT-approved package installer on a test device
- Deny odd permissions (SMS / Accessibility for a "flashlight" game)
- Keep OS + security patch level current; replace EOL devices that never get patches
- Use a strong screen lock; enable Find My Device / remote wipe where policy allows
Sideloading = install outside the store. Lab madhe deliberate weak APK OK on emulator. Production staff phone la cracked Netflix APK = Red's favourite door (banking malware class often pretends to be Flash Player / updater – see Cerberus-class reporting below).
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Ships trojan as "useful" sideload APK | Unknown sources off; Play Protect; MDM blocklist |
| Abuses Accessibility to overlay bank UI | User training; review Accessibility grants weekly |
| Targets unpatched Stagefright-era / old OS | Patch policy; retire devices past vendor support |
Ravindra Bagale's Tip
Students say "Play Protect is on, so I'm immune". Play Protect helps – but greedy permissions + an old patch level still hurt. Interview: permissions + store + patch – three lines. Keep this in mind.
Ravindra Bagale's Tip – मराठी
Students "Play Protect on = immune" म्हणतात. Protect मदत करते – पण permission greed + जुना patch level अजूनही नुकसान करतात. Interview: permissions + store + patch – तीन lines. लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "Play Protect on = immune". Protect मदद करता है – पर permission greed + पुराना patch level फिर भी नुकसान करते हैं. Interview: permissions + store + patch – तीन lines. ध्यान रखो.
Lab
On OWN Android emulator: Settings → see which apps hold SMS / Accessibility / Device admin. Revoke one unnecessary grant. Screenshot before/after for lab book. No third-party phone.
Real incident: Stagefright Android media bugs (2015)
In 2015, Zimperium researcher Joshua Drake publicly detailed critical flaws in Android's libstagefright media library (multiple CVEs such as CVE-2015-1538 and related IDs – verify CERT VU#924951). Crafted media / MMS-class delivery paths could lead to remote code execution on affected versions; researchers and CERT noted a huge fraction of then-active Android devices were in scope, with ecosystem patch lag as the lasting Blue lesson. Google and partners pushed monthly security updates afterward; many older OEM devices still struggled to receive fixes. Defence: timely OS security patches, MMS auto-retrieve caution on stale devices, replace unpatchable phones for work data. Source: Zimperium Stagefright research posts; CERT/CC VU#924951; Android security bulletin history (verify; say "reported" for device-count estimates).
Real incident: Cerberus / Anubis-class Android banking malware (2019 reporting)
ThreatFabric and other researchers publicly described Android banking trojan families such as Anubis (active for years against many financial apps, as reported) and Cerberus (observed as malware-as-a-service rental on underground forums around mid-2019). Typical Blue-relevant behaviours reported: fake apps (e.g. posing as Flash Player), abuse of Accessibility services, overlay phishing for credentials, and hiding icons. Lesson for this section: sideload + dangerous permissions = classic SME phone risk – not only "nation-state" stories. Defence: Play-only installs, deny Accessibility unless truly needed, Play Protect / MDM, user training never to install APK from WhatsApp forwards. Source: ThreatFabric blogs on Cerberus (2019) and Anubis; major security-press summaries (verify; no invented victim totals).