# Mobile protection: Android & notifications > Android protection in the work profile: sideloaded apps, rogue certificates and integrity, your blocklist enforced on device, plus Web Push approvals. Source: https://wahukeza.com/platform/mobile Sense · Mobile protection ## Phones that refuse what your intelligence already knows. Two modules. Mobile Endpoint Protection puts a lightweight agent on managed Android devices: it reports the few things that matter on a phone (sideloaded apps, privileged roles, rogue certificates, integrity) and enforces your blocklist on the device. Mobile Notifications puts the decisions that wait for you on your phone, without making it a second console. Mobile Endpoint Protection · Android ## A closed list of what “unusual” means on a phone. The agent lives in the work profile through Android Enterprise and speaks the same protocol as osquery on your servers, so phones sit in the same endpoint list under the same rules. It reads what an unprivileged app can honestly read, nothing more. - apps ### App inventory Every installed app with its install source (store, MDM, system or sideload) and its APK and signing-certificate hashes. - roles ### Privileged roles Which app holds accessibility, device admin, notification access, screen overlay, default SMS and dialler, keyboard, VPN. - trust anchors ### CA certificates User-installed certificate authorities, the precondition for intercepting the device’s TLS. - posture ### Integrity Root heuristics, bootloader lock, ADB and developer options, security patch level, OS version, Private DNS and VPN state. Seven mobile rules ## Baselined at enrolment, so a new phone is quiet. Everything already on the phone when it enrols is inventory. Detections are about what changes after, and indicator matches, which are never minted from the phone; an analyst confirms. - Sideloaded app An app installed from outside a store or your MDM after enrolment. High when its signing certificate is unknown to every other app on the fleet. - Privileged role An app newly holding accessibility, device admin, default SMS, input method and other roles that let it read or act on the screen. High for accessibility, device admin, default SMS and keyboard. - User-installed CA certificate A new trust anchor: the first step of intercepting the phone’s traffic. - Integrity Bootloader unlocked or root detected (High); developer options or ADB switched on (Medium). - Enforcement off Policy says the phone should be filtering and it is not. Resolves itself when filtering comes back. - Known-bad domain A lookup on the phone matched a domain indicator; the app that made it is named. - Known-bad APK An installed app’s APK or signing-certificate hash matched a hash indicator. High at least. Blocking ## Two tiers. The first needs no agent at all. One tenant-wide policy chooses the mode: monitor (report, block nothing; the default), DNS, or on-device filtering. tier A · Private DNS ### Domains, fleet-wide, no code on the phone. Your MDM points Android’s Private DNS at a resolver kit loaded with the platform’s DNS RPZ feed, over DNS-over-TLS. A domain confirmed on the platform is refused on every phone within one reload. It blocks domains only, cannot say which app asked, and an app with its own DNS-over-HTTPS can step around it, which is why there is a tier B. tier B · on-device filter ### Domains and addresses, named by app. The agent runs as the device’s always-on VPN in lockdown and filters locally: a matched lookup gets NXDOMAIN, a connection to a matched address is reset so the app fails fast. The blocklist is refreshed within about 60 seconds. It never intercepts TLS and never inspects URLs; everything that does not match is forwarded untouched. How a fake banking app is caught ## Installed, escalated, matched, refused, confirmed. 1. 01 ### Installed A staff member installs a “banking” app from a link in a text message. The agent’s inventory reports it: sideloaded, with its APK and signing-certificate hashes. 2. 02 ### Escalates The app asks for the accessibility role, which lets it read the screen and tap for the user. That is a High detection on its own. 3. 03 ### Matched Its signing certificate is unknown to every other app on your fleet: High. If its hash is already an indicator, from your own analysis or a sharing group, that matches too. 4. 04 ### Refused When it calls home, a domain already on your blocklist is refused: by Private DNS, or on the device by the agent’s filter, which also blocks by address and names the app. 5. 05 ### Confirmed An analyst confirms, and the indicator joins the blocklist every phone, firewall and resolver already consume. Phones pick it up within about a minute. Privacy ## Matched, not everything. A managed phone is still someone’s phone. The agent reports only what matched your intelligence or was blocked; the full browsing and connection history never leaves the device, in any mode, and there is no setting to change that. No location, no contacts, no message or notification content. The work profile is the default, so the operating system itself limits the inventory to work apps. The persistent VPN notification is the disclosure, and it links to a screen listing exactly what is collected. [Fake apps in public stores: Brand & fraud protection](https://wahukeza.com/platform/brand-protection) detection · android · work profilehigh rule sideloaded app · signer unknown to fleet app com.bank.secure.update also privileged role · accessibility blocked 3 lookups to a domain on the blocklist not sent other apps’ traffic, location, contacts, messages Illustrative. Mobile Notifications ## Act, don’t author. An installable web app of the platform with Web Push implemented in-house: no Apple or Google developer account, no app store. It runs on Android and on iOS 16.4 and later once added to the home screen. A push carries a pointer, never content: the phone wakes up, then reads the decision through the platform like any other client. - Nothing is proposed from the phone. No response actions, rules, queries, configuration or indicator edits. The phone is for the second human. - Step-up for the big ones. The six highest-consequence approvals ask for a fresh sign-in if the last one is more than 15 minutes old, on any device. - A lost phone goes quiet. Signing out, deactivating the user or resetting their MFA deletes their push subscriptions. - Air-gapped still works. Push needs outbound HTTPS to the browser push services; without it, the app installs and works by polling. /m · waiting for you - Approve or reject a response action Four-eyes still applies: the phone never shows you an action you proposed. - Approve or reject a gated playbook run The playbook’s author and the run’s requester cannot approve it. - Set a phishing verdict With the reason the reporter will see. Close a report or promote it to a case. - Mark a novelty finding Noise, known or novel: the review queue from the Deception Fabric. - Move a case Status, assignee, incident phase with a reason. Straight answer ## What mobile protection does not do. - ### No iOS agent Mobile Endpoint Protection is Android. iPhones get Mobile Notifications, not the agent. - ### No wipe, lock or response on a phone A phone takes desired-state policy and a blocklist, never a command. Wiping and locking stay with your MDM. - ### No URL or content inspection TLS is never intercepted. Blocking is by domain and address. - ### Not a pager Web Push cannot break Do Not Disturb. PagerDuty and Opsgenie remain the pager; this is for decisions waiting for you. - ### Not a store app The agent is distributed through Android Enterprise and your MDM, not a public store listing. It needs Android 10 or later. - ### Not process-level EDR Android does not let one app read another’s processes, files or memory, and the agent does not pretend otherwise. ## Enrol a test phone. Point one managed device at the resolver kit, or install the agent in its work profile, and watch what your intelligence refuses. Both mobile modules are in the Complete package or licensed individually; the number of Android devices is agreed per quote. [Book a demo](https://wahukeza.com/contact?intent=demo) [See the packages](https://wahukeza.com/pricing)