Making the spook in your pocket less spooky: Upgrading the privacy of Android phones

Today, the privacy and security risks and consequences of using smartphones are numerous. 1 2 3 Many smartphone users are either unaware of the privacy risks inherent to using smartphones with default settings and common applications, or have resigned themselves to the apparent unavoidable compromise of privacy in exchange for the convenience of a modern lifestyle and the ability to seamlessly communicate with friends and family. But is that loss of privacy really unavoidable? In this workshop, I will provide an overview of the Android operating system, the common ways that smartphone activity can be tracked, how you can analyze Android applications for privacy and security risks, and how you can configure select Android phone models to better respect your privacy without sacrificing all of the conveniences of the smartphone.

This podcast episode provides a good primer for some of the topics that we will be talking about and implementing in the workshop.

Instructor background

Neil is a software developer with the 781st MI BN, and is an OSINT, online privacy, and Android OS enthusiast.

Prerequisites

All students will need a Windows or Linux computer capable of running Oracle Virtualbox and up to two virtual machines simultaneously. You are also welcome to attend this lab using a Mac, but be advised I will be less able to assist with troubleshooting on that platform due to my unfamiliarity with it. 8 GB or more RAM is highly recommended.

Optionally, students may also bring a hardware Android device that is compatible with the Lineage OS AOSP-based projects. The device must be compatible with unlocking its bootloader and be supported by the Lineage OS project. A complete list of devices compatible with LineageOS can be found here. If you plan to use a hardware Android device during the workshop, please contact the instructor to verify its compatibility beforehand since there are many device variations and some devices feature unlockable bootloaders (or at least, unlockable without resorting to exploit-based unlocking methods that are out of the scope of this workshop).

Depending on how many workshop attendees possess compatible Android devices, we will end the workshop with a guided walkthrough on installing and configuring the popular Lineage OS open source version of the Android OS onto student devices.

Agenda

Part 0: Android Operating System Crash Course

  • Android Runtime (ART)
  • Boot process and boot security features
  • File system
  • Apps and App Permissions Model

Part 0 Exercise 1: Setup and interacting with your Android VM

  • Genymotion or AVD
  • User Interface
  • Android Debug Bridge (ADB) Usage

Part 0 Exercise 2: Android Hello World

  • Intro to Android Studio
  • Building and installing user application on your phone

Part 1: Threat landscape and privacy risks

  • Online Advertising and Data Economy
  • Advertising and Telemetry SDKs
  • Google Play Services
  • Location and Geolocation Services
  • Privacy risks of common apps

Part 1 Exercises: Analyzing and modifying Android apps

  • Automated scanning apps and tools
  • Analyzing app network traffic
  • Decompiling APKs
  • Modifying APKs

Part 2: Setting up and using your privacy-improved Android phone

  • App store alternatives (F-Droid, Aurora)
  • Screening and verifying non-Play Store apps
  • Phone; SMS service through VoIP
  • Multiple User Profiles
  • Other privacy-enhancing user behaviors and OPSEC tips

Part 3: Installing Lineage OS on a compatible Android phone (hardware required)

  • Unlocking bootloader
  • Running custom recovery
  • (optional) Backup user data or factory image
  • Install Lineage OS to system partition
  • Boot phone into Lineage OS
References