RAGBAZteacher's manual
Everything you need to run the unit: objectives, setup, per-lab answer keys and teaching notes, the assessment rubric, and the remediation ladder.
learning objectives
By the end of the unit a student can:
- Explain why mobile compromise assessment is DFIR, not penetration testing.
- Run the five-phase loop on an Android device they own.
- Name the six persistence surfaces and locate each on a live device.
- Operate the collectors, read the evidence, and separate automatic flags from genuine findings.
- Acquire live artifacts read-only and reconstruct a timeline.
- Image the boot chain and verify it against a known-good image.
- Write a report with a calibrated confidence level and a defensible remediation.
- Articulate the limits of userspace triage against a kernel-level rootkit.
lab environment
- Install platform-tools on each workstation; confirm
adb version. - Provision one throwaway device or emulator per group that may be reset freely.
- Pre-stage the three tools and, for Lab 4, the matching OEM factory images.
- For Lab 2, install one benign accessibility + device-admin app per device as the planted target. Keep a record of which app went on which device.
- Optionally install MVT in a venv for the IOC-matching discussion.
Nothing in the unit requires a genuinely infected phone. The planted app is any benign app that requests accessibility and device-admin — that combination is enough to exercise every detection surface.
legal & authorization
Put these on the board before any device is plugged in; authorization discipline is a graded professional skill.
Examine only owned or explicitly authorized devices. Read-only always. No unlocking, rooting, or lock bypass is taught or automated — root/unlock on a lab device is a prerequisite the instructor arranges on owned hardware. Evidence, especially PII, is handled as case material.
Discussion prompt: "You find stalkerware on a device someone handed you. What are you allowed to do next?" The correct instinct is stop, preserve, clarify authorization and consent — not remove it on the spot.
per-lab answer keys & notes
| lab | teaching note / key |
|---|---|
| Lab 1 | No findings expected. Grade clean process: authorized connection, complete hashed evidence set, correct reading of integrity signals. |
| Lab 2 | Answer key is whichever app you planted. Full marks require the app named, the surface(s) identified (accessibility + device-admin), and the proving evidence lines — not just a lucky name. |
| Lab 3 | Grade the fused timeline: install → accessibility-enable → first egress, each cited to a source artifact, with the access mode noted per artifact. |
| Lab 4 | Grade interpretation over mechanics. A student who explains that a match raises but does not prove trust, and a mismatch demands offline analysis, has understood the lab. |
| Lab 5 | Grade the report against the rubric. Weight confidence calibration and the explicit limits statement as heavily as the findings. |
assessment rubric
Grade the report, not the tool run.
| criterion | weight | excellent looks like |
|---|---|---|
| authorization & preservation | 15% | States authorization; defends the reboot / isolation decision. |
| surface identification | 20% | Names the exact persistence surface(s) with evidence references. |
| evidence correlation | 20% | Builds a story across permissions, timeline, and provenance. |
| confidence calibration | 15% | States a confidence level and justifies it via integrity signals. |
| remediation | 15% | Recommendation matches severity — clean vs. reflash. |
| limits & honesty | 15% | Acknowledges what triage cannot see (kernel rootkit). |
remediation ladder
- Suspicious but unconfirmed — preserve, deepen analysis (MVT), do not act.
- Confirmed userspace malware, integrity intact (green + locked) — remove via the appropriate surface, re-run triage to confirm, rotate exposed credentials.
- Confirmed compromise, integrity broken (unlocked / modified boot state) — do not trust removal. Recommend factory reset or reflash and full credential rotation.
Teach the ladder as something students can defend out loud. The honest answer for a broken-integrity device is reflash — and saying so confidently is a sign the unit landed.