44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.1 Mobile Threat Model – What Can Go Wrong
Phone = small laptop with SIM, mic, camera, and your bank. Threats students mix up – thodkyaat clear kara:
| Threat | Simple picture | Blue first move |
|---|---|---|
| Lost / stolen device | Thief has the glass | Strong screen lock + encryption at rest + Find My / remote wipe |
| Malware / rogue APK | Fake "update" or cracked app | Store installs; Play Protect / review; no unknown APK |
| Phishing / OTP steal | Fake SMS / call / page asks OTP | Never share OTP; check URL; bank app from official store |
| Network attacks | Evil twin Wi-Fi, captive portal | Prefer HTTPS; VPN on untrusted nets; skip odd portals |
| Account takeover | Email / Apple / Google session stolen | MFA; revoke sessions from a clean device |
| Targeted spyware (rare) | Mercenary tools against specific people | Updates; Lockdown Mode awareness; specialist help |
Interview line: most SME staff risk = lost phone + weak lock + sideloaded junk + bad Wi-Fi – not movie zero-click every Tuesday. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Steals unlocked phone from desk | Auto-lock short; biometrics + PIN; remote wipe enrolled |
| Tricks user into sideload APK | Block unknown sources; MDM; user training |
| Phishes OTP over SMS / call | MFA apps / hardware keys where fit; staff never read OTP aloud |
| Runs evil twin near office | Prefer cellular / known SSID; VPN; HTTPS-only habits |
Ravindra Bagale's Tip
Students "phone hacked" mhantat for every slow battery. Pehle checklist (44.4), mag scare. Interview: name three everyday mobile risks before you name Pegasus. He lakshat theva.
Lab
Notes madhe 6-row table for fictional Sahyadri Traders (Pune office + Nashik godown): threat | example asset (Raja phone / Rani tablet) | CIA property hurt | one Blue control. 8 lines. No malware install yet.
Real incident: WhatsApp VoIP zero-click path (2019)
In May 2019, Facebook (WhatsApp) published a security advisory for CVE-2019-3568: a buffer overflow in WhatsApp's VoIP stack that allowed remote code execution via specially crafted packets sent to a phone number – widely reported as usable without the user answering the call. Public reporting (Financial Times and others) linked exploitation to delivery of NSO Group spyware (Pegasus-class tooling) against a select set of targets, not mass consumers. WhatsApp shipped patched clients (e.g. Android prior to v2.19.134 and iOS prior to v2.19.51 were called out in the advisory – verify current NVD text). Lesson: keep messaging apps updated; rare targeted spyware exists; Blue still starts with patch + account hygiene, not DIY exploit kits. Source: Facebook / Meta security advisory for CVE-2019-3568; NVD; contemporaneous major reporting (verify; say "reported" for victim counts).