Lab — Android/iOS Hygiene on YOUR Phone

Pick the daily driver whose lock screen you control and whose Google or Apple account is yours. Android or iOS is enough. Do not borrow a friend’s handset. Do not trophy-audit a school tablet. Work MDM that shows YOUR enrolled device to YOU is a status you may read; changing someone else’s policy is not. The lab never needs a malware APK, a jailbreak tool, or a USB cable into a locked stranger. Notes live under $HOME/cyberlium-lab on a computer you own. Ticks come from the phone’s Settings. OEM names differ — search for unknown apps, profiles, lock, notifications, Accessibility, Find My. Record which OS.

cat > "$NOTES" << 'EOF'
=== MOBILE HYGIENE LAB (Cyberlium M17 L04) ===
UNKNOWN_SOURCES_OFF: (Y/N/n/a)
LOCK_UNWRAPS_ENCRYPTION: (Y/N)
FIND_MY_ENROLLED: (Y/N/n/a)
ETHICS: MY phone only; no USB exploit
EOF

Android: Settings → Apps → Special app access → Install unknown apps (path varies). List each source still allowed. Turn extras off. Play Protect: on. iOS: unexpected profiles none, or the one official work profile you enrolled. Do not enable a source “so the lab has something to catch.” Do not install a forum APK. Honest “none enabled” passes. Optional: revoke unused Always-location, strangers in Accessibility, notification access, device admin, appear-on-top. Do not dump a partner’s app list. Do not paste live OTPs into the notes.

grep "UNKNOWN_SOURCES_OFF" "$NOTES"

Confirm a PIN of six or more digits that is not 1234 / birthday, or a passphrase / alphanumeric iOS passcode. Auto-lock quickly. Hide sensitive lock-screen banners. Write the type only — not the PIN. Confirm Find My Device or Find My on YOUR account; MFA that account if it was not. Do not live-erase a working daily driver for a screenshot. Note OS / patch date; reboot if a patch is waiting. Do not install a Telegram “security patch APK.” Official Settings tile only.

grep "LOCK_UNWRAPS_ENCRYPTION" "$NOTES"; chmod 600 "$NOTES"

Pick one account you already own — primary mail, Google/Apple ID, or a bank that offers authenticator/passkey. Enable app or key from a session you started (official app / typed site). SMS-only is weaker. Write the account class only — not the password, not backup codes (those live OFF the phone). If MFA was already on, write “already on; confirmed” — that passes. Do not enroll a classmate’s inbox. Do not read an OTP to a caller.

Still pass if you tell the truth: no backup yet — write “none” and start an official photo backup you own. Nothing enabled for unknown apps — write “none.” Update pending — write pending. MDM greys a toggle — write “MDM issued.” One device — “second: n/a.” Fail: samples, enabling sources to make the audit spicy, café/classmate phones, spyware kits, jailbreak, MDM bypass, someone else’s erase, notes chmod 644/777. Empty notes fail. The helper refuses extra args so it cannot become a remote-phone tool.

Follow the block on a computer you own. Fill blanks from screens you opened. When the notes are filled, chmod 600. The Python helper only prints fields and refuses extra args — it is not a dumper, not a USB tool, not a spy kit.

sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

cat > mobile_hygiene_prompt.py << 'PY'
import sys

if len(sys.argv) > 1:
raise SystemExit("refusing extra args — this is not a spyware or remote-phone lab")

print("audit: MY phone only (Android and/or iOS I own)")
print("fields: unknown_sources_or_profiles, lock_type, find_on_my_account, extra_mfa, ethics")
print("topic6: sideload off, radioactive extras refused, lock unwraps encryption")
print("ethics: no samples, no spyware kits, no classmate/cafe/partner phone")
PY

python3 mobile_hygiene_prompt.py || python mobile_hygiene_prompt.py

cat > "$NOTES" << 'EOF'
=== MOBILE HYGIENE LAB (phone I own) ===
DISCLAIMER: original Cyberlium teaching mapped to the CEH v13
mobile-platforms domain — not official EC-Council training,
not a cert, not exam dumps. Completing this does NOT grant CEH.
DATE_UTC:
DEVICE_OS: (Android / iOS)
UNKNOWN_SOURCES_OR_PROFILES: (list or none; extras I turned off)
PLAY_PROTECT_OR_APP_STORE_HABIT: (on / typed official listing)
LOCK_TYPE: (PIN six+ / passphrase / iOS passcode — NOT the secret)
AUTO_LOCK_AND_NOTIFICATION_HIDE:
FIND_SERVICE: (Find My Device / Find My on MY account, MFA'd)
PATCH_OR_OS_VERSION:
ONE_EXTRA_MFA: (account class only — mail/Google/Apple/bank; NOT codes)
RADIOACTIVE_EXTRAS_REFUSED: (Accessibility/SMS/overlay/admin looked Y/N)
MDM_OR_WORK_PROFILE: (yes/no/n/a — issued as issued)
TOPIC6_CARRY: sideload, permissions, lock+find — same checklist, CEH ethics frame
ETHICS: NEVER samples; NEVER spyware kits; NEVER others' phones;
NEVER jailbreak/root how-to; NEVER MDM bypass
EOF

cat > check_mobile_hygiene_lab.py << 'PY'
from pathlib import Path
import sys

if len(sys.argv) > 1:
raise SystemExit("refusing extra args — this is not a spyware or remote-phone lab")

path = Path.home() / "cyberlium-lab" / "mobile-hygiene-lab.txt"
text = path.read_text(encoding="utf-8")
keys = [
"DISCLAIMER",
"UNKNOWN_SOURCES_OR_PROFILES",
"LOCK_TYPE",
"FIND_SERVICE",
"ONE_EXTRA_MFA",
"TOPIC6_CARRY",
"ETHICS",
]
missing = [k for k in keys if k not in text]
if missing:
raise SystemExit("FAIL missing keys: " + ", ".join(missing))
low = text.lower()
banned = (
"sideload sample",
"spy kit",
"classmate phone",
"wipe partner",
"bypass mdm",
)
if any(b in low for b in banned):
raise SystemExit("FAIL notes look like a kit or someone else's phone")
if "NOT official EC-Council" not in text and "not official EC-Council" not in text:
raise SystemExit("FAIL disclaimer must say this is not official EC-Council training")
print("PASS: headings present for", path)
print("ethics: MY phone; sources off; lock; extra MFA; chmod 600")
PY

python3 check_mobile_hygiene_lab.py || python check_mobile_hygiene_lab.py

"$HOME/cyberlium-lab/mobile_hygiene_prompt.py" \
"$HOME/cyberlium-lab/check_mobile_hygiene_lab.py"

You read your own doors, wrote the ticks, locked mobile-hygiene-lab.txt, and left other people’s phones and the spyware aisle closed. That is authorized mobile-platform literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Mobile Platforms — ten APPLY items on the vault, install doors, lost-device/MDM, this lab, and legal scope. Then Module 18: Default Creds and Unpatched Firmware — IoT you own, still not a camera hunt.