Android fundamentals: architecture, permissions and updates
You get to know Android's layers, permissions, app isolation and storage, and make a phone safe with screen lock, updates, Play Protect and the work profile.
Level 101 · 33 lessons · 27 practice labs
Lessons
Getting to know Android
- Android versions, API levels and vendor differences
- Architecture layers: kernel, HAL, ART, framework and apps
- App, package name and APK: what an app is on a phone
- A tour of settings: the security and privacy screens
- Short task: find the simulated device's Android version, patch level and vendor
Permissions and app isolation
- Permissions: normal, dangerous and special
- Runtime permissions, one-time grants and auto-reset
- The app sandbox: a separate user for every app
- Storage: app-private space, shared storage and the SD card
- Short task: find an app's unneeded permissions and revoke them
Safe use and administration
- Screen lock, biometrics and device encryption
- Updates: security patch level and Play system updates
- Play Protect and installing from unknown sources
- Backup, find my device and remote wipe
- The work profile: keeping personal and work data apart
- Short task: harden a phone with a ten-point checklist
Getting to know the simulated device with adb
- What adb is: the bridge between a computer and a phone
- adb shell: the file system and basic commands
- Reading device settings with getprop and settings
- Listing and filtering installed packages with pm
- USB debugging and developer options: the risk of leaving them on
- Short task: list the user-installed apps on the simulated device
Where apps come from and how they behave
- Install source: finding out who installed an app
- Reading an app's permissions from settings and the command line
- Notifications, background work and battery restrictions
- Accessibility services and device admin apps
- Short task: find the sideloaded apps and note their risks
Network, accounts and privacy
- Wi-Fi, Bluetooth and NFC settings: safe defaults
- VPN and private DNS
- Accounts, sync and two-step verification
- The privacy dashboard: camera, microphone and location access history
- Short task: find the app that needlessly uses the microphone from the access history
Capstone
- Capstone: audit a new starter's phone and make it safe
Practice labs
- Find the simulated device's version and patch level: Use adb shell to pull the simulated device's Android version, security patch date and vendor from getprop output.
- Compare the patch state of two devices: Compare the properties of two simulated devices and work out how many months each has gone unpatched.
- Write a script that produces a device fact card: Write an adb script that gathers version, patch, model, encryption state and bootloader lock into one output and run it on the simulated device.
- List the apps the user installed: Use pm to list only the user-installed packages on the simulated device and state how many there are.
- Separate disabled apps from system apps: Split the package list into system, user and disabled groups and find the security app that is unexpectedly disabled.
- Go from package name to APK path and version: For three given packages, extract the APK path, version name and first install time into a table.
- Find out who installed an app: Query the install source of the given package on the simulated device and say whether it came from the store or by hand.
- Find every sideloaded app: List the packages on Ilgıntepe Tekstil's field phone whose install source is not the store and write a risk note for each.
- Audit the apps allowed to install from unknown sources: Find which apps hold the permission to install other apps, identify the needless ones and write the steps to turn it off.
- Read the permissions granted to an app: List the dangerous permissions granted to a notes app on the simulated device.
- Revoke a needless permission from the command line: Find the contacts permission granted to a calculator app, revoke it with pm and confirm the result.
- Find the apps with background location access: Extract every package with background location permission and sort them into needed and needless by function.
- List the apps with an accessibility service enabled: Read the enabled accessibility services from the simulated device's settings and state which package each belongs to.
- Audit the device admin apps: List the active device admins, find the one not deployed by the organisation and write the order for removing it.
- Produce a full inventory of special access: Gather the apps with accessibility, notification access, overlay and usage data access in one table and flag the suspicious combination.
- Confirm the screen lock setting: Find the screen lock type and auto-lock timeout on the simulated device.
- Report encryption and bootloader state: Extract the device's encryption type, bootloader lock and verified boot state and compare them with the policy.
- Fix a phone left with developer options on: Check USB debugging, network debugging and mock location, turn off those that are on and document the final state as proof.
- Read the Play Protect and update status: Find whether app scanning is on and the Play system update date on the simulated device.
- Report a device that no longer gets updates: Compare a device's model and patch date with the support schedule and write a short note recommending replacement.
- Apply the ten-point hardening checklist: Audit the simulated device against the ten-point list, mark passes and fails and fix each failing item.
- Read the private DNS and VPN settings: Extract the private DNS mode and the active VPN app from the simulated device's settings.
- Find the open network among saved Wi-Fi networks: Find the passwordless, auto-connecting network in the saved list and write the steps to remove it.
- Find the app needlessly using the microphone from history: Examine the permission usage history, find the app using the microphone at night, revoke its permission and confirm.
- List the users and profiles on the device: List with pm how many users and profiles the simulated device has and identify the work profile.
- Find which profile an app is installed in: Show with evidence whether the same email app is installed on the personal side or in the work profile.
- Audit a new starter's phone end to end: Audit the phone of a new starter at Demirsu Enerji for version, lock, app sources, permissions and work profile and write a one-page result.
About this course
You get to know Android's layers, permissions, app isolation and storage, and make a phone safe with screen lock, updates, Play Protect and the work profile.
What you will learn
- Getting to know Android
- Permissions and app isolation
- Safe use and administration
- Getting to know the simulated device with adb
- Where apps come from and how they behave
- Network, accounts and privacy
- Capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.