0

I am using a paid (non-free) antivirus on my Android 13. I am curious however, what would be the signs/"symptoms" in case I have data leakage/security issues/trojan on my smartphone? How can someone identify that?

1
  • 1
    Lots of analysis on what is normal and what is not normal behavior of your smartphone. For "cheap" malware maybe visible odd behavior. But in case of professional malware you maybe never know without in depth analysis (which is harder on the average smartphone).
    – secfren
    Commented Dec 16, 2022 at 17:44

1 Answer 1

1

Vague notions

If you're an active internet phone user that watches videos and has auto-update enabled, then you could expect (ed. the bandwidth used by) any process that steals metadata and text-based content will be almost indistinguishable from your normal use (eg. messages/ location/ radio/ usage/ websites/ fingerprints of images/ etc.)

If software is picking up your imagery and sending it elsewhere, this will almost certainly show up as increased bandwith and power consumption.

You might notice an increase in power consumption (drop in battery life, higher temps) if some processes are working a lot. Unless the spyware is poorly written, this would likely show up as the +/- your day-to-day usage (ed. you would have to be looking at longer-term trends or anomolies during idle periods).

Evidence-based

Take extra measures to do better than tea-leaves...

You can instal loggers that will keep track of network, battery, power and temperature over time. You will probably want to ensure these are open-source and (or) from a reputable dev.

Instal a tool called ClassyShark or ClassyShark3xodus to scan all of your installed apks for any known tracker fingerprints. This will allow you to identify potentially whiffy software, and look for alternatives. (As far as I know it won't catch custom software - it relies on devs importing 3rd-party spyware tracking library code into their apk.)

Instal an open-source software firewall on your device, eg. two good options are AFWall+ (requires su) or Netguard (conflicts with vpn usage). Once you have this software installed you can intercept- ed. and log- attempts to connect to the internet in most cases, and take an option to refuse the connection- temporarily or permanently. (UDP can be problematic.)

Make your phone connect to the internet via another device that you have low-level control over and keep a log of the activity. You could then use Wireshark on the gateway/ proxy host to inspect the connections, at least. You now have the problem that most network transactions will be encrypted and you probably won't be able to decrypt unless you have the session keys from the phone itself. (There are various utilities and frameworks atdre'17-19 that can allow you to trace and capture information from system activity and intercept encrypted comms, requires su.)

... opinionated rant ahead

Go through all of your settings and set everything to the most restrictive. Get into the habit of disabling data, radio-networks, and location, when not in use.

Disable any su if you've enabled it. Leave it disabled until you need it. Keep usage logs if possible.

Disable installation of software from untrusted sources, only enable if you need it. If you sideload apks then be sure to check the signature (or at least the digest) of the release that you're downloading. (Check it with ClassyShark also.)

Encrypt the system and have a boot-time key that is different to your lockscreen. Be aware of "smudge attacks".

Switch to (or add) an open-source software repo eg. F-Droid. There is a pretty good collection on there already, and being limited to opensrc, it makes it easier for you to find software that can be scrutinised.

Don't use an untrusted software repo simply to avoid using play store. Aurora play client seems promising in this space, but I don't know how it guarantees the authenticity of apks that it obtains from play on your behalf, so don't take this as anything more than a lead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .