44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.4 Signs a Phone May Be Compromised – Practical Checklist
No invented percentages. Symptoms can be malware – or a bad battery / chatty app. Checklist → investigate → do not panic-format first.
Suspicious signals (combine, don't obsess on one):
- Unknown apps you did not install; icons that vanish but process remains
- Accessibility / Device admin granted to apps you do not recognise
- Battery / data use jumps with phone idle (still check which app – not proof alone)
- Settings changed: unknown VPN profile, proxy, APN, or configuration profile
- SMS / call oddities: 2FA messages for logins you did not start
- Account alerts: Google / Apple / bank "new sign-in" you do not recognise
- Overlays that ask for bank PIN outside the real bank app
- Friends report spam from your WhatsApp / email
Document: screenshot, note time, do not factory-reset before capturing basics if company IR needs evidence – then follow 44.5.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Hides malware icon; keeps Accessibility | Periodic permission audit; MDM inventory |
| Steals session cookies / tokens quietly | Account login alerts; revoke sessions early |
| Uses overlay on banking app | Official bank apps only; warn on fake skins |
Ravindra Bagale's Tip
Students ekdach factory reset martat ani evidence / password reuse sodtat. Checklist → clean-device password change → mag wipe. He lakshat theva.
Lab
Pair with Zoya: she lists 8 checklist items; you mark which need MDM screenshot vs home-user action. Fictional Shraddha Bagale staff phone – write 6-line "first hour" notes. No scanning classmates' phones.