Lesson 4.21: A suspicious app on a company phone
Can from sales says his company phone has been slow and hot for a week, and that a 'System Update' once asked him to switch on an accessibility option. Malicious apps on Android rarely exploit anything: they ask. Installed from outside the store, they request SMS access, accessibility (which lets an app read the screen and tap for the user) and notification access, and use them to steal one-time codes and sessions. In the lab you connect to Can's phone, find the app that didn't come from the store, see what it was granted, keep a copy as evidence, and remove it.
18 min
You will learn to
- Explain how mobile malware gains its powers
- Find sideloaded apps by their installer
- Review granted permissions
- Check accessibility and notification access
- Preserve evidence and remove the app
Key terms
- Sideloading
- Installing an app from an APK file instead of a store.
- Accessibility service
- An app that can read the screen and act for the user, meant for assistive tools.
- Notification listener
- An app allowed to read and dismiss all notifications.
- Indicator of compromise (IOC)
- Evidence that identifies a threat: hashes, package names, certificates, addresses.
- Google Play Protect
- Android's built-in app scanner, also for sideloaded apps.
← How ransomware works · All lessons · TCP: the three-way handshake, flags and connection states →