Unit 1: How phones are built to defend · Lesson 4 of 5 · 18 min
Rooted and jailbroken phones
Read integrity verdicts, separate a modified phone from an old one, and decide what each may reach.
mission
- You are
- You are the IT analyst at Kestrel Field Services.
- Situation
- The MDM asks Google Play Integrity about every Android phone each day. Six phones are flagged in some way.
- Goal
- Work out which flags mean the phone was modified and which mean it is just behind.
- Hand in
- A list of modified phones and a list of phones that need updates.
Rooting or jailbreaking gives you, and any app you trust, power over the whole phone. That switches off the sandbox, verified boot and often the update channel all at once.
Play Integrity verdicts, from weakest to strongest
| Command | What it does |
|---|---|
Basic | The app runs on some Android device, maybe emulated or modified |
Device | A genuine Android device that passed system integrity checks |
Strong | Device integrity plus hardware-backed proof and a recent security patch |
Find the phone that fails even the basic check
Sort the Integrity tab by Basic.
you should see One phone fails everything, with a root manager found on it.
Separate modified from merely old
Filter the Note column for Old security patch. These phones are genuine, they are just behind, and they fail only the strong verdict.
you should see Four phones need updates, not an investigation.
Check how the modified phones are managed
Look up KFS-A-028 and KFS-A-029 in the Inventory tab.
you should see One is BYOD with a work profile, one is not enrolled at all. Neither should reach company data.
defender tip On iPhone the equivalent signal is a jailbreak detected by your MDM or mobile threat defence app. Treat it the same way: block, then talk to the owner.
Two phones that both fail the strong check
Basic: No Device: No Strong: No Note: Root manager package found
Modified. Block and talk to the owner.
Basic: Yes Device: Yes Strong: No Note: Old security patch
Genuine but behind. Update it.
What a defender takes away
- 1Rooting and jailbreaking switch off the protections this unit is about.
- 2A failed strong verdict often just means an old patch.
- 3Compliance rules should block modified phones automatically.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.