Install Sources and Permissions

Modern Android does not use one global “unknown sources” checkbox. Each app that can start an install — Files, Chrome, Telegram, Gmail — has its own Install unknown apps privilege. Default is off. Enable one source, install the one package you already verified via a URL you typed, disable that source again. Attackers want any one source left on forever. iOS cousins: unexpected configuration profiles, “trust this developer,” and enterprise stories you did not request from official IT — delete profiles you did not enroll on purpose. Mirror blogs are not your IT department. Prefer not to sideload. Never enable sources so a lab has something spicy to catch.

cat >> "$NOTES" << 'EOF'
unknown_sources: per-source trust switch — default off
refuse: packing APKs for classmates
EOF

Topic 6 named the keys malware begs for. Accessibility can observe a banking session and tap Approve — there is no separate “malware Accessibility,” only who you enroll. A tutorial that says “turn this on or the saver will not work” is the exploit. SMS reads the OTP inbox. Notification listeners read 2FA banners without SMS. Device admin makes uninstall a fight. Draw-over paints a fake pad on the real bank. Job-match: flashlight → not Contacts, not SMS, not Accessibility. First-run extras: Deny. Audit Special app access on a phone YOU own. Do not “test” a sideloaded APK. Do not dump a partner’s permission list — Topic 6 already refused that line.

Play Protect and App Store review reduce risk. They are not certificates that the listing is the brand. Topic 6’s fake-listing lesson still applies: type the vendor hostname you already know, follow their store badge, confirm the developer. A million downloads can still be a clone. Keep Protect on. Do not sideload a file “to watch the warning.” Detonating samples is how people infect the only phone that holds their authenticator. Automatic updates for apps you already trust are patches, not a reason to leave every messenger as an installer. If IT requires a specific source, that source stays the exception. Circumventing MDM is Lesson 3 and is out here too.

Root and jailbreak mean processes can leave the per-app sandbox that makes permission prompts meaningful. Topic 6 named the costs: unlocked bootloader, attestation failures, delayed patches, worse malware impact. “Hide root” tutorials are dual-use and out. If a bank app refuses to run, the answer is stock and locked — not a hide module. This is not a tutorial: no fastboot sequences, no Magisk, no USB unlock of a device you do not own. Do not jailbreak a classmate’s iPhone as a portfolio piece. Custom ROMs are not Module 17 homework.

Notes are boring on purpose. Date (UTC). Unknown-source / profile state on a phone YOU own (list still allowed, or “none”). Radioactive grants you refuse unless job-matched. Play Protect / typed-listing habit. Root/jailbreak named as out — no steps. Ethics: no samples, no packing, no intercept-SMS, no classmate grants. Legal: original Cyberlium teaching mapped to the CEH v13 mobile-platforms domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/install-permissions-notes.txt, chmod 600. Honest “none enabled” passes. Enabling Telegram “so the lab has a row” fails. 777 and dorm-APK gists fail. No live OTPs in the file.

On a computer you own, fill the notes from Settings you opened on a phone YOU own — not from a blog screenshot. Run the checker. chmod 600. Optional the same sitting: turn extra install sources off so the file matches the device. Lesson 4 will tick the full hygiene list; this file is the permission door.

cat >> "$NOTES" << 'EOF'
install_habit: type official listing in the store I trust
filters: review + Play Protect — still not proof of innocence
EOF

You now treat install sources and extra permissions as doors you refuse unless the job matches — Topic 6 carried into a CEH ethics frame — and you treat samples, intercept scripts, and other people’s phones as out. Notes are locked. This is original Cyberlium teaching mapped to the CEH v13 mobile-platforms domain — not official EC-Council training, not a cert, not exam dumps. Next — Lost Device and Work Profiles — lock, encryption, remote locate on YOUR Google or Apple account; MDM as separation, not a bypass.