I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I have very good reason to believe that both my phone and computer (Ubuntu 18.0.4) are being monitored.
I am using Charles Proxy on my Ubuntu machine (which may and likely is also infected). My phone connects to Charles, and then I am using Wireshark to capture all the outgoing traffic from my phone.
So far, I have not seen anything really suspicious when analysing the network. There doesn't seem to be any odd activity when the phone is silent, or when I am just typing in a notes application. But I would like to know, if my method here is correct, and sufficient to capture the packets potentially leading to a spyware of some sort.
The way I see it, if for example a key logger has been installed then the key stroke information has to be sent out at some point, and so it shouldn't be able escape Wireshark.
I am very new to security/network security. So I am wondering is my method above correct?
Please let me know if this is not the right way to go about this, or perhaps if you can kindly direct me to links/books/any resource which would allow me to know for sure my devices are free of spyware.
The potential attacker in this case, is someone fully capable of writing a sophisticated software. He is a senior software developer with resources to hire a talented hacker. I have been on the same network as him in the past (have formatted and factory reset devices since then) and has had physical access to my computer at some point, but not phone.