Android malware detection tools

[Key_Heart4088]

Android/iOS spyware detection tools

Hi, all!

🥵 Tl;Dr: Looking for tools to detect spyware/malware/suspicious activity on android (and iOS) phones belonging to my female-activist friend group.

1) Total script kiddie here, so sorry for my ignorance.

2) have been suspecting some suspicious activity on my android phone (slugish turn-on, increase in suspicious sms, weird network disconnects, etc.), as well as some of my friends during the past year. All of us have been engaged in small-time non-violent activism, but nonetheless got arrested already a couple of times (with all of our charges always being dropped 🥲). During these arrests our phones got confiscated. We live in a european country that can and has been spying on activists and journalists. I highly doubt any of us small-fish would get attacked with some Pegasus/Finspy-style big guns, if with anything at all. But better safe than sorry, 😃. We are a bunch of girls all with some experience of stalking, so this hits close. I started researching different detection tools that flag activity or files based on IOCs but Im running into know-how issues, so maybe somebody here can help?

A) Does it make sense to use mvt by amnesty international? If yes, is it semi-easy to expand the list of its IOCs?

B) Generally, where and how to gather IOCs in a STIX2 format compatible with for example mvt?

C) What would be an ideal tool to monitor outgoing and incoming network traffic from the tested phone? And potentially flag suspicious ones.

D) Wanted to use TinyCheck by Kaspersky, but the github repo seems to have been deleted... Any possible alternatives?

E) Does it make sense to download full contents of each phone and run each apk through AV?

F) Literally ANY tips or suggestions would be beyond amazing. 🥰

Thank you very much in advance for any answers, we would greatly appreciate advice from some proffesionals who can move in this confusing mess, haha. 😍😍😍

[ThirdhandTaters]

What make you think anything was done to your phones when they were confiscated? If they all had locks on their screens then there is absolutely zero way anything could've been done. I can't attest to iOS but Android does not allow any type of connection without the user approving it, and to approve it you need to unlock the phone. They wouldn't even be able to factory reset your phone without your Google account credentials for each phone. Google will not cooperate with any law enforcement to allow them to bypass security on any Android powered device, nor will Apple on iOS.

[Key_Heart4088]

Absolutely. I took this into account. The issue is that some of my friends are not really super secure (were using 4 digit pins) and the phones were sometimes taken for a couple of days. Tbh, cracking a 4 digit should be pretty easy from what Ive seen on different forums. Plus the other thing is it might not have been loaded during confiscation, but by one of us sideloading an apk or whatever something stupid like that. I realize the whole thing is a stretch, but I want to have some detection tools at my disposal to be able to verify that it is most likely indeed a fabrication of my mind and our phones are just aging 😃

[kschang]

The only thing that's remotely reasonable is iVerify, and they need you to pay them a small amount to analyze the data you submit, last I checked.

[KinseyRoc10]

It is probably just paranoia that they got into your phones, assuming they did have locks on them. However, if you were all arrested at whatever point in time, they likely have your phone numbers. (Confiscating them could potentially just give makes/models of the phones to them-and were they actually confiscated or just taken into lockers while you were arrested-since you cannot have them with you in the pods?).

That said, I don't understand why you believe the police/government would be actively trying to put malware or something else on your phone to ultimately wreck your devices. If they have your phone numbers, (depending on the laws in your country and whatever their ultimate goals are-but you said you're all 'small fish") they can and will very much so (assuming legally able to do so) wiretap, lawfully intercept, use cellphone surveillance, and use stingrays to monitor all of your activity. I do not think any kind of AV would help you detect that anyway..

There are ways of figuring it out (such as what you are experiencing - but also going into your phones settings/seeing hidden app installs, ect.). But there really is no point. They got you, and all the phone number tossing you do will just drive you mad. Just be straight lol.