Android App Security · Spotting Bad Apps · Lesson 5 of 5

Challenge: The Parcel Text

Trace how a bad app got onto a relative's phone, then clean it up.

Case brief

Your uncle Dev calls for help with his Android phone. Here's what he remembers.

• Last week he got a text saying a parcel couldn't be delivered, with a link to "track and reschedule".
• The page told him to allow his messaging app to install unknown apps, then install "ParcelTrack".
• ParcelTrack asked him to turn it on under Accessibility. The switch was locked, so the app showed a step by step guide, and he followed it from the app's App info menu.
• He tapped through a warning about full control.
• Yesterday, when he opened his bank app, the login page appeared, he signed in, and then it asked him to sign in a second time.
• This morning there's a payment he didn't make, and ParcelTrack's Uninstall button is grayed out.

Use what you've learned in this course to work out what happened and how to fix it.

The second login

Dev's bank says its app never asks for a second sign in during a normal login. ParcelTrack had accessibility access, so it could tell which app was on screen. It may also have had permission to draw on top of other apps.

Think about what Dev really typed into the first login page, and why the real app then asked again.

The stuck uninstall

First you open the app list in normal mode, but ParcelTrack keeps closing Settings every time you tap on it. So you boot Dev's phone into safe mode, where downloaded apps can't start and fight you. Settings now stays open. The Uninstall button on ParcelTrack's App info page is still grayed out, though. Looking around the security settings, you notice ParcelTrack listed on one more screen that Dev doesn't remember ever visiting.

Locking the accounts back down

ParcelTrack is gone and a Play Protect scan comes back clean. Dev is relieved and wants to move fast. His plan is to change his passwords right now on the same phone, then restore last night's full backup so his home screen and apps look normal again. He hasn't told his bank about the payment yet, because he wants to see whether more money goes first. He also has a laptop at home that ParcelTrack never touched.