Thread by @rafaybaloch

Thread: Protecting Mobile Devices

Contrary to the popular belief, doing a factory reset on your phone does not guarantee removal of sophisticated spyware. As per recent analysis by @citizenlab , Pegasus spyware can persist a factory reset on certain android phones.

If you are a high profile target, always assume that your mobile devices are likely to be targeted. While, the following steps can't ensure protection against sophisticated cyber weapons they will surely help reduce the attack surface.

1. Do not link any cloud accounts to your mobile device.

2. Change your password on regular basis, use a different password for each service and if you use a password manager, only use it to store "Password Hints" instead of actual passwords.

3. Periodically log out of your email accounts.

4. Do not store whatsapp, telegram and other OTT services chat backups on cloud.

5. Store bare minimum data on your mobile device, and all secrets should be kept encrypted and stored offline.

6. Replace your mobile device once in a while and do not buy refurbished phones.

7. Use multi-factor authentication on all of your email accounts, ensure that phone number linked with these accounts should not be publicly known and linked to your identity. A better approach is to use hardware authentication device such as Yubikey or FIDO U2F Security Key.

8. Do not click on any links at all, always move links to a sandboxed environment and then view then. However this advice is not practical as links are meant to be clicked, however following this religiously will prevent you from "One Click"

Feel free to add your suggestions to this thread. #cybersecurity #privacy #infosec