Following Scenario:

You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install spyware on you phone without your knowledge. Without you looking, can that person go to settings > allow downloads from unknown sources and type in their site where they have a link for spyware in the browser, start the download and install it on your phone.

  • Is this possible in 1 minute?
  • Are there any other barriers to doing this, other than the fact that you might catch them?
  • Can spyware be downloaded and installed in a short time frame?
  • 1 minute is enough if you have good internet connection.
    – defalt
    Oct 1, 2021 at 19:45
  • If it does get installed where will it hide? I read it can be an app but that would be easy to spot, you can find it easily if you go to settings and check applications right? If it doesn't stay hidden as an app how does it stay hidden? How can you spot it?
    – Shaki49
    Oct 1, 2021 at 21:49
  • w/ a custom otg cable and some other equipment you could prob do it in a few seconds. Oct 1, 2021 at 22:57
  • User-installed apps cannot be hidden. You can always go through applications to recognise the app you know you didn't install. It's slightly difficult to spot the spyware if it has ambiguous name which tricks most people to believe that the app must be used by system.
    – defalt
    Oct 2, 2021 at 8:30
  • So spyware only stays hidden as an application? It can't hide like a system file in settings or somewhere else, like part of the operating system?
    – Shaki49
    Oct 2, 2021 at 8:38

2 Answers 2


Is this possible in 1 minute?

It's not impossible:

  1. Open Camera and point to a QR-Code. 10 seconds

  2. Open browser and download the APK file. Depending on the file size, it can take 20 seconds or less.

  3. Open the APK, if you installed anything from the browser before, no confirmation is needed. Depends on the APK size too, but can be done in 5 to 10 seconds.

  4. If confirmation is needed, attacker can go to the settings tab straight from the install screen. More 5-10 seconds here.

So best case scenario it could be done in 40 seconds.

Are there any other barriers to doing this, other than the fact that you might catch them? Can spyware be downloaded and installed in a short time frame?

There are few barriers you can set, the main one if not allowing people to use your phone. Or install a custom ROM that disallows installation of APK files without putting the PIN or fingerprint.

And spyware can be downloaded and installed in a short timeframe. It only need to install a loader, and it can be very small. After installation, this loader can download more modules as needed.

  • Will the phone ask for the passcode before the download or install?
    – Shaki49
    Oct 1, 2021 at 18:17
  • Android won't ask anything if the phone is already unlocked.
    – ThoriumBR
    Oct 1, 2021 at 18:22
  • What is a loader? when you set u an account every time you download something from play store it asks for your password right? so its not the same with downloading from google?
    – Shaki49
    Oct 1, 2021 at 18:42
  • A loader is a small app that will download the other parts of it. Like the Firefox installer for Windows: it's a small executable (less than 10 MB) that will download the rest of the files.
    – ThoriumBR
    Oct 1, 2021 at 19:17
  • I read that you can check your phone to see if you have "symptoms", like battery drainage, mobile data depletion and one of them was to see if allow downloads from unknown sources was turned on. Why would that matter? Wouldn't the person turn off allow downloads from unknown sources after installing spyware to hide his tracks as if it was never tampered with? Or if you turn it off the spyware won't work? Does it matter whether it's on or off after spyware has been installed?
    – Shaki49
    Oct 1, 2021 at 21:42

Even quicker scenario: a USB rubber ducky or similar could be plugged into the device's USB port. The attacker does not need to interact with the screen at all if the phone is unlocked and the device is programmed correctly, as the device will simulate an auto-typing keyboard.

Alternatively, and similar to the QR code method, an NFC tag could be placed near the phone, causing it to open a download link with little effort.

The biggest device-specific hurdles would be enabling unknown application sources and granting permissions, due to differences in vendor UIs. There shouldn't be a need to authenticate at any point. Once installed, the app generally needs to be started once before it is allowed to start on its own; this could be part of the script. There would likely be no further steps to take within the app unless it's an off the shelf product of a certain sort.

Once installed, the unknown sources option could be disabled again.

  • If the person who downloaded and installed spyware ignored the warning from play protect and installed his spyware, will you detect it if you do a system scan on play protect after it has been installed and it starts running?
    – Shaki49
    Oct 2, 2021 at 8:41
  • @Shaki49 it depends if Play Protect is actually capable of identifying it as malicious. Oct 2, 2021 at 13:41
  • So will spyware always appear as an application or will it be something else? For example: some of those paid “parental control” spyware apps will stay hidden as a settings app. Can it be hidden in a different way, which doesn’t appear anywhere?
    – Shaki49
    Oct 2, 2021 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .