1

I need to add extra security to my Android device using iptables and a firewall to defend against hackers. My specific goals are to prevent a hacker from remotely breaking into my device to begin with and, in the event spyware is remotely placed on my device, my data/activity cannot be uploaded to whatever command center the hacker controls. Which commands should I use for maximum hacking defense? So far I only know about closing all ports except 80 and 443. I also need to know how to block all ports except those two, both incoming and outgoing, without preventing myself from browsing the web and other basics.

5
  • 'my goal is... in the event spyware is remotely placed on my device, my data/activity cannot be uploaded to whatever command center the hacker controls' and 'without preventing myself from browsing the web and other basics'. To browse the web, your firewall needs to allow outgoing connections on ports 80 and/or 443. If your firewall allows outgoing connections on ports 80 and/or 443, then connections to the attackers' server on these ports can be used to upload your info to their servers.
    – mti2935
    Commented Mar 3, 2021 at 23:10
  • True. Well, even with that being a factor, what are all the commands I should use to add extra security? And I'd still like to close all ports except 80 and 443. I found a guide near the end of this page: bobcares.com/blog/iptables-block-port-range but it needs some changes
    – guestmar21
    Commented Mar 4, 2021 at 0:41
  • Oops, it doesn't need any changes.
    – guestmar21
    Commented Mar 4, 2021 at 7:14
  • @guestmar21 there are no "commands" to learn. Firewalls have rules. Antivirus is configured by the vendor. From all your comments, I think that you have some misunderstandings and confusion about how all this works, which is making it impossible to answer your questions directly. The concept you are looking for is "hardening". And hardening is far more than just firewalls and antivirus. And on a phone, doesn't even include firewalls.
    – schroeder
    Commented Mar 4, 2021 at 8:38
  • OP, you may want to consider using ufw (uncomplicated firewall). ufw runs 'over' iptables, and ufw makes it much easier to configure simple firewall rules than using iptables directly. See digitalocean.com/community/tutorials/… for more infol
    – mti2935
    Commented Mar 4, 2021 at 14:27

3 Answers 3

2

I wonder what corporations and politicians and oil barons do to protect their devices from targeted hacking?

Ask Jeff Bezos or Angela Merkel, they'll know. Oh wait ...

It always depends on your adversary. There's a difference between Joe hacker and the NSA.

The average Smartphone usually does not expose any public internet services itself and is often behind some NAT anyways. So theoretically no one from the outside can connect to it directly. Often you "invite" attackers by connecting to their phishing websites, installing some crap app ... Telemetry/Tracking is also just some kind of legal version of exfiltration.

Preventing exfiltration is nice in theory but in practice only limiting traffic to port 443 and 80 still gives the attacker the ability to exfiltrate data over those ports. Not to mention some lower level stuff like WIFI, Bluetooth, mobile network ... Smartphones are made to communicate in many ways.

The average politician targeted by the average nation state better does not do any stuff on his phone which could have negative impacts on him. Like storing all his duck pics ...

The true chad politician, however, would store all his duck pics there on purpose because a) remove the attack vector of some moral outrage and b) because the images exploit some vulnerabilities on the attackers system and send all their duck pics to youduck.com 2:0

You'd better prevent or detect the step which happens before exfiltration i.e. compromise. You'd need to know what the system does normally and when it misbehaves. You also need to know if normal=desired (see telemetry ...) That's a lot of work. iptables/firewalling is only a small part of it

1

On a typical Android device from a reputable manufacturer, all inbound ports should already be closed out of the box. Unless you know for a fact that some ports are open for whatever reason, I don't see the benefit in setting up a firewall to close inbound ports that are already closed.

For closing outbound ports other than 80 and 443, this also comes across to me as likely to be highly ineffective and mostly providing a false sense of security. If I were an attacker, the most obvious way to exfiltrate data out of a device without raising immediate red flags would be to put up a standard web server and send the data via an HTTPS request on port 443. So allowing ports 80 and 443 pretty much also allows the most straightforward data exfiltration method.

Overall I'd say that a firewall just isn't an effective tool for this job. You'll get a lot more actual security by following standard common sense practices, like using a device that is receiving security updates regularly and being cognizant of the apps you are installing.

3
  • Thanks. I wonder what corporations and politicians and oil barons do to protect their devices from targeted hacking? I find it hard to believe that everyone with a smartphone or a computer is just a sitting duck with no truly effective way to defend themselves from hackers.
    – guestmar21
    Commented Mar 4, 2021 at 7:24
  • @guestmar21: There are several basics: Just don't install arbitrary apps on the phone. Protect your phone against physical access by others. Use a phone where the vendor provides fast and reliable software updates. Commented Mar 4, 2021 at 12:44
  • @guestmar21 I would refer you to this recent blog post from Google Project Zero to get a sense of what it takes to hack a smartphone. One the one hand, it takes incredible talent and time to discover an attack like this. Not many individuals would be able to pull it off. On the other hand, it only took one guy six months to discover a way to gain complete control of every iPhone in their vicinity. Imagine what a government capable of hiring hundreds of similarly talented people can do?
    – tlng05
    Commented Mar 5, 2021 at 10:57
0

No system is 100% secured. What you can do is mitigate or minimize risk. You cannot avoid Risk. If you want to avoid risk you have to avoid using this solution/device or service.

As per your comment, you are ready to disconnect it from internet. Keep your device isolate environment. That mean don't connect device into external network such as internet. You are secured from internet based attack. You don' need additional commands to execute.

But still you are not 100% secured.

1
  • I understand that there is always a risk, I've even heard people say that "all" operating systems are "swiss cheese" to hackers. But iptables and antivirus and etc. exist for a reason so I would like to learn some commands.
    – guestmar21
    Commented Mar 4, 2021 at 6:49

Not the answer you're looking for? Browse other questions tagged .