# MA-628.072016: MyCERT Alert - Best Practices on Mobile Phone Security

**Date:** 22 Jul 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-628.072016  
**Advisory ID:** MA-628.072016

---

**1.0     Introduction**
Mobile phone has become increasingly important and a necessity for many users and businesses. They are used for communications, browsing the Internet, reading emails and for storing personal/business data.
Just like computers, mobile phone is exposed to various threats such as malware infection, data theft and software vulnerabilities.
The extremely risky practice such as downloading application from unverified trusted sources could lead user to download malicious application that will compromise the mobile device and networks it accesses.
**2.0    Recommendation**
MyCERT highly recommends users to follow the best practice to safeguard their mobile phones:
•    Set a password for your smart phone. All of the major smartphone operating systems allow you to set a password and automatically lock your phone after a period of inactivity.
•    Verify application permission and the application author or publisher before installing it.
•    Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
•    Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
•    Don't use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user's smartphone/tablet.
•    Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
•    Do not root or otherwise 'Jailbreak' your phone; avoid side loading
(installing from non-official sources) when you can. If you do install Android software from a source other than the Market, be sure that it is coming from a reputable source.
•    Switch off Bluetooth if it is not in use. If you’re not using your Bluetooth connection, it is best to switch it off. That way, you’ll make your phone less vulnerable to attacks.
•    If your smartphone is found to be infected with a malware, you can simply uninstall the malware from your smartphone.  However, if uninstalling does not remove the malware, then you need to reinstall the Operating System of the smartphone (refer to phone manufacturer) to completely remove the malware.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#97f4eef5f2e5aeaeaed7f4eef5f2e5e4f2f4e2e5fee3eeb9faee) or [[email protected]](/cdn-cgi/l/email-protection#264b5f45435452664b5f4543545208495441084b5f) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**3.0 References**
- <https://www.mycert.org.my/portal/advisory?id=MA-436.122014>
- <https://www.mycert.org.my/portal/advisory?id=MA-416.092014>
- <https://www.mycert.org.my/portal/advisory?id=MA-425.112014>