I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?
The scope of this question is too large. Is the phone stock? Running a custom ROM or rooted? Could he have guessed your PIN (looking at grease marks on screen)? When you say spyware do you mean an app from the store or custom apk?
I would say no, this is not possible, in normal circumstances. If you suspect something why not just wipe the phone and sync all your data back and vet the applications?
If your roommate has physical access to your phone, then yes it's very possible. Given that he is your roommate, it means he can access your phone while you're sleeping or taking a shower.
Are there ways to do this? Yes, but the methods your room-mate will have access to will heavily depend on a few things:
1) Have they had physical access to your phone? If so, there is a technical possibility that they used a tool like ODIN to flash a compromised image to your phone. This needs a lot of Android building mastery however, and even more skills if you aren't using a custom ROM in order to conceal it. Samsung ROMs are a hard nut to crack
2) Do you use custom recovery software? (eg:TWRP) If yes and your phone is unencrypted, this gives them carte-blanche access to your phone.
3) Is your phone rooted and:
3a) did they persuade you to install an APK they gave you?
3b) would they have had a chance to install anything themselves?
If yes to either of those, it's a real possibility.
4) Is your phone's bootloader unlocked? If you don't know what this is, it's probably not unlocked. If it is unlocked, this allows an attacker to install custom recovery software (see #2)
Your roommate would need to be incredibly skilled to pull any of this off, however. Android devices are far more secured than your typical Windows machine of yesteryear or even today. Chances are your roommate has simply guessed your password or is shouldersurfing when you use your phone.
There are highly sensitive spywares out there that can be bought online, which only require your Bluetooth to upload. Also, there are spyware softwares that can be uploaded by phone calls, texts and email attachments. There are also apps that can figure out passwords in the same manner as a phone-auto-redial. All of these softwares are available online and can be bought with a price. It's not rocket science, it's just every technology that is built, the same builder finds several ways to break in. It's like you building your own house, getting locked out and not knowing how to get in if you lost your key, a builder always prepares. Smartphone's are about the same as computers and face similar spyware problems. Nothing, no technology is 100% secure. Protect yourself for that.