Lab — Personal Malware Hygiene Audit

Pick devices whose lock screen you control and whose accounts are yours. A personal phone plus a personal laptop is the intended pair. If you only have one, audit that one and write “second device: n/a.” Do not borrow a friend’s handset “because the lab wanted Android.” Do not open a school-managed laptop’s unknown-source policy as a trophy. Work MDM that already shows YOUR enrolled device to YOU is in scope as a status you can read; changing someone else’s policy is not. The lab never needs a malware file. A throwaway folder under $HOME/cyberlium-lab holds notes only — not a samples directory, not an unpack of an APK.

Windows users: Settings → Windows Update (status and last checked), backup (File History, OneDrive, or whatever you actually use), SmartScreen / app reputation if shown, and whether you sideload unsigned installers as a habit. Android: Settings → System update / Security patch, backup or Google One / OEM cloud, Play Protect, and Special app access / Install unknown apps (per-source list). iOS if that is your phone: Update, iCloud backup date, and the fact that sideload is not the Topic 6 door — still write the patch and backup ticks. Record which OS so the notes are reproducible on YOUR box.

cat > "$NOTES" << 'EOF'
=== MALWARE HYGIENE LAB (Cyberlium M07 L04) ===
UPDATES_ON: (Y/N/partial)
BACKUPS_ON: (Y/N/partial)
UNKNOWN_SOURCE_OFF: (Y/N/n/a)
ETHICS: no samples, no detonate, no hack-back
EOF

Updates: product name, patch date or “pending reboot,” source = Settings tile you opened (not an email). Backups: last success, what is covered (photos vs full image), whether a copy exists the encryptor cannot reach, and whether you have ever restored a harmless file as a drill. Unknown-source: list each Android source still allowed, or “none”; on PC write whether cracked/unsigned installers are a habit you are stopping. Family recall (one line): virus/worm/trojan/ransomware as delivery+intent — prove Lesson 1 still fits in a sentence. Foothold recall: email / sideload / macros still refused. If dirty tomorrow: isolate, revoke from clean device, trusted reinstall, restore files. chmod 600 on the notes and the helper.

Failure modes that still pass if you tell the truth: no backup yet — write “none,” start one official backup you own, do not invent a date. Phone has no “Install unknown apps” page because nothing is enabled — write “none enabled.” Update pending — write pending and reboot if you can. Failure modes that fail the course: success against a sample you downloaded, packing a test dropper, enabling unknown sources “so the lab has something to catch,” auditing a café tablet, notes chmod 644 on a shared PC with specimen paths.

sudo apt install python3

brew install python3

grep -E "UPDATES_ON|BACKUPS_ON|UNKNOWN_SOURCE_OFF|ETHICS" "$NOTES"
python3 - << 'PY'
from pathlib import Path
t = (Path.home()/'cyberlium-lab'/'malware-hygiene-lab.txt').read_text(encoding='utf-8','replace').lower()
print('FAIL zoo' if 'virustotal pack' in t or 'malware sample' in t else 'PASS: no sample-zoo language')
PY

Follow the block on a computer you own. Fill blanks from screens you opened, not from memory of a blog. When the notes are filled, chmod 600. Optional: turn off extra Install unknown apps sources the same sitting so the file matches the device.

You read your own doors, wrote the ticks, locked the file, and left the zoo closed. That is authorized malware-threat literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text. Next — Quiz — Malware Threats — ten APPLY items on families, foothold refusals, and defensive hygiene. Then Module 8: What a Sniffer Sees on YOUR Network — still no café capture, still no malware samples to generate traffic.