Mobile Malware · Cutting Off Malware · Lesson 4 of 5

Network Defenses for Phones

DNS filters, company gateways and security apps that keep malware from calling out.

Blocking at the DNS layer

Malware usually has to look up a domain name before it can reach its operators. That makes DNS one of the cheapest places to stop it. A filtering resolver is a DNS service that checks each lookup against lists of known malicious domains. If a name is on the list, it doesn't return the real address, so the connection never starts.

In Encrypted DNS you set Android's Private DNS to a provider hostname. Some providers offer filtering versions. Cloudflare documents security.cloudflare-dns.com as its malware blocking hostname, and Quad9 lists malware blocking as part of its main service at dns.quad9.net. Entering one of these under Private DNS gives the whole phone a basic layer of protection on Wi-Fi and mobile data alike, with lookups encrypted too.

Those lists come from threat intelligence: information about attacks gathered by security vendors, researchers, national CERTs and the provider's own analysis, then shared as blocklists of domains and IP addresses. When a report like Kaspersky's on SparkCat publishes its indicators, those domains can be added to blocklists quickly. Some company filters also block or flag newly registered domains, since few legitimate business services depend on a domain created yesterday.

DNS blocking is useful, but it has limits:

• It only knows what's been reported. A domain nobody has spotted yet won't be listed.
• An app can bypass the phone's DNS settings, for example by connecting straight to an IP address or doing its own lookups. That's why companies add the controls in the next task.
• It blocks connections, it doesn't remove malware. A phone that keeps trying a blocked domain is still infected.

That last point turns out to be valuable. Blocked lookups are logged, so a filtering resolver doubles as an alarm. Many companies watch for exactly this: one device repeatedly asking for a name on the blocklist.

For most people, a filtering Private DNS is a reasonable extra layer, not a replacement for updates, Play Protect and careful installs.

Company controls, filtering apps and privacy

Companies layer more controls on top of DNS. At a high level:

• Egress rules. Egress means traffic leaving a network. A firewall can allow the destinations and ports a business needs and block or log the rest, which makes unusual connections stand out.
• Secure web gateways. A secure web gateway sits between devices and the internet, checking web traffic against company policy and threat intelligence. Many are cloud based, so they can cover phones outside the office too.
• Mobile threat defense (MTD). MTD is a category of security apps for phones, usually deployed through the company's device management system. They look for risky apps, suspicious networks and outdated software, and can mark a phone as risky so it loses access to company email until it's fixed.

Individuals have a version of this. On Android, many security and ad blocking apps use the phone's built in VPN feature to create a local VPN. Instead of sending your traffic to a distant server, the app routes it through itself on the phone, checks lookups against a blocklist, and drops the bad ones. It's popular because it works on any network without special settings. One catch: Android runs only one VPN at a time, so a filtering app and a regular VPN can't both be active.

Every one of these tools sees a lot. A DNS resolver learns every name you look up. A gateway or MTD app on a work phone may report network activity to the company. A filtering app with VPN access sits in the path of all your traffic, so a dishonest one could become the very problem it claims to solve. Before installing or accepting one, ask:

• Who runs it, and what do they log?
• How long are the logs kept, and are they shared?
• On a work phone, what exactly can the company see?

Many companies use a work profile, a separate managed space on the phone, so they control work apps and data without seeing personal ones.

The goal is the same everywhere: make it hard for malware to reach its operators, and make it obvious when it tries.