Safe App Installation

Google Play Protect (Play Store → profile → Play Protect, or Settings → Security) scans installed apps and can warn or disable potentially harmful packages it already knows how to spot. Keep it enabled. Turn on the scan-apps and improve-harmful-app-detection options the UI offers. That is a reputation and behavior net, similar in spirit to a mail filter: strong on yesterday's known-bad, weaker on first-seen lookalikes Module 1 already described. Protect does not mean "the Play Store is incapable of hosting a fake." Module 1's fake-listing lesson still applies. Protect also does not mean you should sideload a suspicious file "to see the warning." Detonating samples is how people infect the only phone that holds their authenticator. If Protect flags something you already use and you trust the vendor, update from the official listing or uninstall; do not download a "cleaner" that promises to silence Protect. Silencing Protect is a bypass. This course does not teach bypasses.

Automatic updates for apps you already trust are how security patches arrive without a ceremony. Leave them on for the Play Store catalog you actually use. That is not the same as auto-installing every suggested app. Review the Protect scan list occasionally the way you review Permission manager: unfamiliar names get uninstalled, not "allowed because the icon is a shield."

Modern Android does not use a single global "Unknown sources" switch the way very old versions did. Each app that can start an install (Files, Chrome, a messenger, a browser) has its own "Install unknown apps" permission. That is least privilege for sideloading: you can allow Files for one corporate APK your IT told you to use, then turn Files back off, without leaving Telegram allowed to install whatever a group chat drops. The mechanism: an APK is just a file until an installer component with that permission hands it to Package Manager. Attackers want any one source left on forever — especially chat apps — so the next "update.apk" is one tap. Default is off. Enable one source, install the one package you already verified, disable that source again. Do not leave Chrome able to install from every download. Do not "test" a random APK to see whether the prompt looks scary. If you do not have a verified, necessary sideload, you do not need the permission at all.

Enterprise and school devices may use managed Play or a private store. That is a different trusted channel, not a reason to enable every messenger as an installer. If IT requires a specific source, that source stays the exception, documented, not a lifestyle. Mirror sites and "APK pure" blogs are not your IT department. Hash-checking a file from a random blog is an advanced, easy-to-get-wrong practice this course will not pretend is beginner-safe. Prefer not to sideload. When you must, official vendor site via typed URL plus the vendor's published signature story — still not a Telegram ZIP.

Search inside a store is how lookalike listings win: "BankName" plus a shield emoji outranks the real app on a bad day. The defensive path is the same as Topic 5's typed official site: open the browser, type the bank or vendor hostname you already know, follow their Get the app / Play badge to the listing. Then confirm the developer name against that site. A million downloads can still be a clone; a brand-new developer with the right logo is a clone until the domain you typed says otherwise. Read recent reviews for "stole my SMS," "accessibility scam," "overlay," "can't uninstall" — those are lesson-1 symptoms in user English. Star averages lie; a burst of five-star one-liners the same week as a permission change is a tell. Permissions on the listing (where shown) still get the job-match test: flashlight ≠ SMS. At first run, deny every prompt that is not required to show the one feature you installed the app for. You can grant Camera later when you actually take a photo. You cannot recall an OTP that already went to a listener.

Uninstall is part of install hygiene. Apps you do not use still hold grants, still start on boot if they asked, still appear in Protect's backlog as more surface. Remove them. Do not keep a "maybe later" folder of sideloaded tools. The checklist below is meant to be copied into your notes and reused — not performed against a malware museum.

Write the checklist into a notes file. The next time you actually need an app, run the list before Install. Do not go hunting APKs to practice on. If you have no pending install, walk Play Protect and the Install unknown apps list on your phone and record their state. That is the lab. Downloading "something sketchy to refuse" is how people refuse too late.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/safe-install-checklist.txt"

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "ethics: no random APKs, no Protect bypass, no live malware reverse"
  echo ""
  echo "=== DEVICE DEFAULTS ==="
  echo "play_protect_enabled: yes/no  (Play Store → Play Protect)"
  echo "unknown_install_sources_still_on:"
  echo "  (Files / Chrome / Telegram / other — turn OFF after any needed sideload)"
  echo ""
  echo "=== BEFORE TAP INSTALL (copy this block per app) ==="
  echo "[ ] Reached listing via typed official URL (not store search alone)"
  echo "[ ] Developer / brand matches the official site"
  echo "[ ] Recent reviews do not describe SMS / Accessibility / overlay theft"
  echo "[ ] Permissions match the job (flashlight ≠ SMS)"
  echo "[ ] Play Protect is on"
  echo "[ ] Unknown sources stay OFF afterward"
  echo "[ ] First run: Deny extras; grant later only if the feature needs it"
  echo ""
  echo "app_name_or_none_pending:"
  echo "decision: install / wait / refuse"
  echo "uninstalled_unused:"
} > "$NOTES"

chmod 600 "$NOTES"

You now treat every Install as a source-plus-permission decision. Play Protect stays on as a scanner, not as a dare. Unknown-app install stays off per source. Official listings come from typed URLs; reviews and developer names are evidence; first-run Deny keeps lesson 1 intact. You do not test malware by installing it. Next — Rooting Risks — you learn what uid 0 and an unlocked bootloader cost in banking apps, updates, and malware impact, without any how-to for rooting.