44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.9 Hardening Checklist and Permission-Hygiene Lab
Print for Rani's staff briefing:
- Screen lock: PIN / passphrase + biometrics; short auto-lock
- Encryption at rest: modern Android / iOS with lock enabled (default path) – do not leave devices unlocked
- OS + app updates weekly habit
- App permissions: revoke mic/camera/SMS you do not need
- Stores only; unknown sources off
- MFA on Apple / Google / email / bank
- Bluetooth / Wi-Fi hygiene (44.7–44.8)
- MDM enrollment for company phones
- Backup strategy that does not re-poison after wipe
- Lost-phone: track / wipe + account revoke same day
# OWN host-only lab – tiny "mobile portal" target for later project (Amazon Linux)
# On 192.168.56.50:
sudo yum install httpd php
sudo service httpd start
sudo service httpd status
# Place a deliberate weak PHP login under /var/www/html/mobile/ (lab only)
# From Kali 192.168.56.10 – ONLY host-only:
# curl -s http://192.168.56.50/mobile/login.php
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Hopes staff never review permissions | Monthly permission hygiene drill |
| Uses stolen phone unlocked | Auto-lock + wipe + encryption |
| Targets EOL Android without patches | Hardware refresh policy |
Ravindra Bagale's Tip
Checklist wallpaper useful – pan prove on emulator: revoke permission → app feature breaks → user understands why grant mattered. Samjla ka?
Lab
Path A: Android emulator – install a harmless demo app you built / a known open lab APK; grant then revoke Storage / Camera; screenshot. Path B: browser-only – review permissions pages on YOUR phone Settings. Path C: stand up weak HTTP mobile login on .50 for the project. Ethics signature: own devices only.