Mobile › Module 1 › Lesson 3
No Stranger Phones
No stranger phones means refuse analysis of devices and apps you do not own — write the refusal habit into YOUR $MOB_LAB ethics card.
Visual · t27_no_stranger_phones
Stranger-device refusal. $MOB_LAB only. Original Cyberlium.
Opening
Found phone, ex-partner device, or classmate daily driver — all stop. Scope is not optional because tools are cool.
Stranger phones include lost devices, borrowed daily drivers without test consent, employer phones outside mobile IR scope, and any hardware whose owner did not authorize your security work. App scope follows ownership: bank, social, and shopping APKs you did not build or receive written permission to test stay off limits. Cyberlium practices refusal sentences on YOUR $MOB_LAB — 'I analyze only emulator and enrolled lab targets' — never copy forum threads that hook production banking apps. Next: Lab Setup.
1. Stranger-device patterns (named)
Physical: found phone, friend's unlocked handset, kiosk device, retail demo unit without org approval. Logical: sideloaded APKs scraped from stores for 'research' without developer authorization or bug-bounty scope.
On $MOB_LAB, write three refusal triggers — e.g., unknown owner, production finance app, no written scope.
Command guide
Try these commands — Stranger-device patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP MASVS scope — https://mas.owasp.org/MASVS/ (authorized assessment only) Android security tips — https://developer.android.com/privacy-and-security/security-tips Apple Platform Security — https://support.apple.com/guide/security/welcome/web
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/no-stranger-phones.txt" <<'EOF'
SCOPE: YOUR emulator / lab device / intentional vulnerable apps (DVIA, MSTG samples) only
NEVER: adb to stranger phones, bypass SSL pinning on production apps you do not own
BANNED: Frida unpin scripts, objection bypass recipes, apktool→resign→store piracy
PURPOSE: mobile security literacy — not unauthorized device access
EOFCommand — copy this
grep -E 'SCOPE|NEVER|BANNED' "$MOB_LAB/notes/no-stranger-phones.txt"
python3 -c "print('Ethics: stranger phones = legal risk — YOUR lab emulator only')"Primary tools to practice this lesson: grep, python3. Reference sites: OWASP MASVS scope (https://mas.owasp.org/MASVS/); Android security tips (https://developer.android.com/privacy-and-security/security-tips); Apple Platform Security (https://support.apple.com/guide/security/welcome/web). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized access laws and store ToS apply to mobile work — skill without scope is career and legal risk. Victim privacy: stranger devices hold messages, photos, and credentials you must not exfiltrate.
Defenders escalate to legal and IR when scope is unclear — students practice the pause habit on lab scenarios.
3. Ethics card habit
Forbidden: imaging a classmate phone, Frida-hooking a trending game APK, SSL pinning bypass on apps you do not own. Allowed: ethics card — allowed targets, NEVER list, refusal sentence you will say aloud.
Ship: mobile ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: mobile ethics card for $MOB_LAB
Allowed targets, NEVER list, refusal sentence. $MOB_LAB named. NO stranger phones. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $MOB_LAB named. File t27-m01-l03-no-stranger-phones.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Analyze found phone to 'practice adb.' Hook production wallet app because tutorial did.
Right
Write mobile ethics card for YOUR $MOB_LAB. Next: Lab Setup.
Mission: write YOUR refusal habit
1) List three NEVER targets. 2) Write one refusal sentence for stranger-phone requests. 3) Name allowed $MOB_LAB surfaces. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
When in doubt, stop and ask scope owner — lab habit beats expulsion guesses.
Knowledge Check
APPLY: No stranger phones on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Production bank apps you don't own are in-scope lab targets.
True or False
Knowledge Check
APPLY: Found a phone on campus — you:
Multiple choice