# MA-735.072019: MyCERT Alert - Alert on Mobile Phone FAQ

**Date:** 26 Jul 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-735.072019  
**Advisory ID:** MA-735.072019

---

**1.0 Introduction**
MyCERT received several enquiries from complainants claiming that their mobile phones may have been compromised. As a guide, we have provided a FAQ on Mobile Phone Security, so users can identify if it is a security incident or 
**2.0 Mobile Phone Security FAQ**
Listed below are frequently asked questions regarding mobile phone security:
1. How can I tell if my phone is hacked?
More than likely you will not be able to determine if your phone has been hacked or compromised without the knowledge of the operating system and device hardware. However, you may notice your phone exhibiting new behaviors like becoming slower, crashing, and having excessive battery drain. Some users received enormous data usage bills from their service providers after malicious adware was installed on the device.
2. What are mobile security threats?
Mobile security threats are vulnerabilities or attacks that attempt to compromise your phone's operating system, internet connection, Wi-Fi and Bluetooth connections, apps or data at rest in your smartphone.
3. How can you tell if your phone has been hacked?
Six signs your phone may have been hacked
- Noticeable decrease in battery life.
- Sluggish performance.
- High data usage.
- Outgoing calls or texts you didn't send.
- Mystery pop-ups.
- Unusual activity on any accounts linked to the device.
4. What to do if you think your phone has been hacked?
If you think your phone has been hacked there are two important steps to take: Remove apps you don't recognize: if possible, wipe the device, restore factory settings, and reinstall apps from trusted app store
5. How to stay safe while installing app on a smartphone?
There are a few things you can do to stay on top of app security.
- The best way to stay safe is not to immediately avoid any apps that require problematic permissions, but instead to look at the app itself and use reasoning to figure out whether the app really requires these permissions.
- Users can also send an email to the developer asking about the permissions. If the reply is not satisfactory or if the user did not get a reply at all, then probably give the app a miss.
- Users should also take advantage of the huge Android community if unsure about the security of an app. Read reviews in the Play Store and check forums and Android-centric news sites to see if there have been any complaints about the app recently. It is a bit of work, sure, but better be safe than sorry.
- If buying a new smartphone that comes with applications pre-installed by the manufacturer, we recommend uninstalling unnecessary applications and re-installing any social media applications directly from the official Google Play Store.
6. How do I stay safe while using Wi-fi and Bluetooth?
Don't use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user's smartphone.
7. What is your opinion about Jailbreaking iPhone and Rooting Android phone?
Do not root or otherwise 'Jailbreak' your phone. This give administrator privilege to access the device filesystem and malicious app could take advantage. These activities also may void your phone warranty. Unless you know what you are doing, then don’t do it.
8. There are apps that I like but not available in official store, instead I had to sideload it, is it ok?
Avoid side loading (installing from non-official sources) when you can. If you do install Android software from another source than the official app store, be sure that it is coming from a reputable source.
9. Why it is always recommended to download and use apps only from official application store such as Google Play Store or Apple App Store?
Before any app can be published, developer has to register themselves and submit their details for background screening. If approved, only then they will be granted an access to developer program and publish their apps. Once developer submit their apps to the official store, the app will go through a rigorous checking which will inspect their code, checking apps behavior to detect any malicious functionality and the app reliability. If the app has malicious behavior that can oppose security risk to end user or violates any terms and policy, the app will be not published into the official store. If the app passed all the checking and verified, only then it will be published and available to end user. Thus, give the end user confidence and safety when downloading and using these app from official store.
10. Can my smartphone get infected by malware?
Yes, but for infection to happen, it requires user to click and install it. Attacker may use social engineering to trick user to download and install it. Therefore, always verify whenever someone ask you to install unknown application in your smartphone. Avoid installing application that has been modified or from unofficial application market.
11. What should do when I receive spam call impersonating as law enforcement agency?
If you received such scam phone call, which impersonates local law enforcement agency, you can immediately:
- Immediately end any suspicious call and never respond to any instruction
- Refer directly to the financial institution mentioned during the call and check with them.
- Contact the respective law enforcement agency for verification.
12. What if I receive any verification code although I have not requested any?
Usually, verification code such as TAC (Transaction Authorization Code), OTP (One Time Password) or any verification code is sent to the registered phone number tied to the registered account. This code is used to provide additional authorization and security against unauthorized access to your account or transaction and to verify that you are the person you are registered to be. If you received any verification code to validate any transaction or verification to your account without you request it, do not share this code to anyone and immediately report this activity to the respective party that maintaining your account and change the credential of your account immediately. Sharing this code to any requested party will result in financial loss or compromising your personal data or privacy.
Generally, MyCERT advises the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
<https://www.techlicious.com/tip/how-to-tell-if-your-phone-has-been-hacked/>