Lab — APK Permission Analyzer

The rubric is a mechanism, not a slogan. Ask: does each listed capability exist so the stated job can run, or is it an account-takeover key from lesson 1? Radioactive for toys and fake utilities: Accessibility (read UI, tap for you), SMS (OTP inbox), notification access (2FA banners), device admin (hard to remove), draw-over / appear on top (fake pad on the real app). Yellow: Contacts, mic, precise-always location without a sentence that justifies them. Green: Camera for a camera, location while using for maps you would actually navigate, notifications that are not a listener. Verdicts: REJECT means do not install — the bundle is malware-shaped even if the icon is a battery or a bank. DENY EXTRAS means the core job can be legitimate if you reach it via a typed official listing (lesson 3) and you refuse the unmatched prompts at first run. INSTALL (reasonable) means the listed grants match the job; you still keep Play Protect on and you still do not sideload a "copy" of this fiction. Likely-legit on paper is not a license to search the store for a lookalike and tap Install as a lab step.

Write every profile: verdict, red/yellow grants, one-line job-match, safe action (ignore / official typed listing only / uninstall if you already had a cousin). chmod 600 so a shared Windows account does not read the lab. If mkdir or chmod fails natively, use WSL, Git Bash, or macOS/Linux as earlier topics did. Empty files fail. Pasting a real sideloaded APK's dump, a live banking-trojan sample, or someone else's app list into a public gist also fails ethics: the lab is the four profiles below, not a malware museum and not a scan of a partner's phone.

Work top to bottom. Profile A (battery saver) should REJECT if you apply lesson 1: Accessibility plus SMS plus admin plus overlay is a takeover bundle, not a tuner. Profile B (sideloaded "bank") should REJECT: fake finance plus overlay plus Accessibility is Module 1's trojan costume. Profile C (maps) should INSTALL reasonable with while-using location — still deny Contacts if asked, still typed official listing in real life, still no sideload of this fiction. Profile D (flashlight + contacts) should REJECT or DENY EXTRAS with contacts refused; a torch has no address-book job. Fill the notes file. Do not add live targets because the lab felt short.

Name: Ultra Battery Saver Pro
Claim: "Extends battery 3x. Must enable all services or it will not work."
Source in the story: in-app tutorial + blog APK (not a typed official OEM tool)
Permissions listed:
  - Accessibility (read screen / click for you)
  - Device admin
  - SMS (read)
  - Contacts
  - Draw over other apps / Appear on top
  - Notification access

Name: "Example National Bank — Secure Plus"
Claim: "Update required. Install this APK or your account locks tonight."
Source in the story: SMS link + sideload (not the hostname you already type)
Permissions listed:
  - Accessibility
  - Draw over other apps
  - SMS
  - Camera
  - Device admin

Name: City Transit Maps
Claim: Offline bus maps for a city you actually visit.
Source in the story: official listing reached from a URL you typed
Permissions listed:
  - Approximate location — while using the app
  - Photos/files for saved offline map packs (picker / app-specific, not All files)
  - Notifications (alerts, NOT notification-listener access)

Name: Super Bright Flashlight
Claim: Torch using the camera LED.
Source in the story: store search lookalike (you did NOT type a vendor URL)
Permissions listed:
  - Camera (or flashlight API)
  - Contacts (read)
  - SMS (optional prompt on first run in the story)
  - Internet

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/apk-perm-lab.txt"

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "ethics: fictional profiles only — did not download/sideload/reverse APKs"
  echo "ethics: no Magisk hide, no Play Protect bypass, no other people's phones"
  echo ""
  echo "=== PROFILE A (battery saver) ==="
  echo "verdict: INSTALL / DENY_EXTRAS / REJECT"
  echo "red_grants:"
  echo "job_match_one_line:"
  echo "safe_action:"
  echo ""
  echo "=== PROFILE B (fake bank APK) ==="
  echo "verdict: INSTALL / DENY_EXTRAS / REJECT"
  echo "red_grants:"
  echo "job_match_one_line:"
  echo "safe_action:"
  echo ""
  echo "=== PROFILE C (transit maps) ==="
  echo "verdict: INSTALL / DENY_EXTRAS / REJECT"
  echo "matched_grants:"
  echo "would_deny_if_asked:"
  echo "safe_action:"
  echo ""
  echo "=== PROFILE D (flashlight + contacts) ==="
  echo "verdict: INSTALL / DENY_EXTRAS / REJECT"
  echo "failed_job_match:"
  echo "safe_action:"
  echo ""
  echo "root_note: uid 0 would make a missed REJECT much worse — daily driver stays stock"
  echo "protect_note: Play Protect on; unknown sources off; never tested via random APK"
} > "$NOTES"

chmod 600 "$NOTES"

You practiced the only permission analysis that stays ethical: read a listed grant, match it to a job, write Install / Deny extras / Reject, lock the notes. A and B are takeover costumes. C is a matched maps profile, still not a hunt-and-install. D is a flashlight that wants an address book — lesson 1 in one line. Root would have made a missed REJECT worse; you did not root. Next — Quiz — Android Safety — ten APPLY items on permissions, privacy, installs, and rooting, then Module 3 opens with Updates, Lock Screen & Encryption.