Check the five mobile persistence surfaces on a device you own

short · 30 min · Objective 3.3

Task

Check the small number of places a mobile compromise can persist -- profiles, device administrators, accessibility services, certificates and installation sources -- and record what you find. Five minutes per device covers essentially every route, which is the useful thing to know.

Steps

  1. Record every configuration or work profile in lab/mobcheck/profiles.csv with header profile,installed_by,what_it_grants,recognised.
  2. Record every application with device administrator rights, and every accessibility service that is enabled, in lab/mobcheck/rights.csv with header app,right,why_it_would_need_it,recognised.
  3. Record installed root certificates and any VPN configuration in lab/mobcheck/trust.csv with header item,type,installed_by,recognised.
  4. Record the installation source for at least eight applications in lab/mobcheck/sources.csv with header app,source,in_store_history,recognised.
  5. Write lab/mobcheck/findings.md listing anything unrecognised, what you would do about each, and -- if there is nothing -- recording that clean result and how long the whole check took.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" profile(s)"}' lab/mobcheck/profiles.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" elevated right(s)"}' lab/mobcheck/rights.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" trust item(s)"}' lab/mobcheck/trust.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" app source(s)"}' lab/mobcheck/sources.csv
awk -F, 'NR>1 && $4 ~ /no/ {n++} END {print n" unrecognised source(s)"}' lab/mobcheck/sources.csv
grep -c . lab/mobcheck/findings.md

All four surfaces checked with eight application sources, and a findings note that is not empty even when the result is clean. A clean result recorded with a time taken is exactly as valuable as a finding -- it is what makes an unclean device recognisable later.

Notes

Accessibility services is the surface worth the most attention. It exists so assistive software can read the screen and act for the user, which means an application granted it can read everything and tap anything.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.