How do attackers break into smartphones and tablets, and what makes mobile devices so much harder to defend than traditional computers? Mobile platforms are everywhere — in your pocket, on the factory floor, in hospital wards — and each one runs a complex operating system that can be exploited in ways that surprise even IT professionals. For the Certified Ethical Hacker exam, understanding mobile vulnerabilities and Mobile Device Management (MDM) is critical because over 60% of corporate data is now accessed from mobile devices, and the exam tests your ability to spot the specific attack vectors that target phones and tablets.
Jump to a section
A simple way to picture Hacking Mobile Platforms
A busy hotel with hundreds of rooms and guests coming and going. The front desk gives you a key card that opens only your room and maybe the gym, but not the conference room or the manager's office. This key card works through a central system that checks who you are and what you're allowed to do.
Now imagine a hacker sits in the lobby and copies your key card's magnetic stripe data using a small handheld reader as you walk past. They then reprogram a blank card with your hotel's master key code — the one that opens every single door including the back office and the safe. They walk in at 2am, unlock any room, and no one stops them because the card looks legitimate.
Mobile hacking works the same way. Your smartphone has a mobile operating system that controls what apps can access — like your camera, contacts, GPS, and messages. Attackers find ways to break that control, either by tricking you into installing a fake app (side-loading), exploiting a weakness in a system update (vulnerability in the OS), or bypassing the company's mobile device management profile that's supposed to keep corporate data safe. Just like the hotel's master key system, once the attacker gets that level of access, they can move freely through your device's most sensitive areas.
Mobile platforms refer to the operating systems that run on smartphones, tablets, and wearable devices — primarily Google's Android and Apple's iOS. These operating systems manage hardware resources, enforce security policies, and control which apps can do what. Unlike a laptop where you can install antivirus software, mobile OSes are locked down by design. That's both a strength and a weakness.
Let's break down the key concepts.
Mobile Operating System Vulnerabilities
A vulnerability is a flaw in the software that an attacker can exploit to do something they aren't supposed to. In mobile OSes, vulnerabilities appear in several places:
Kernel flaws: The kernel is the core of the OS that talks directly to the hardware. If an attacker can run code in the kernel, they have complete control over the device.
Privilege escalation: This is when a normal app gains access to system-level permissions. For example, an app that should only read your contacts suddenly gets access to your microphone.
Unpatched software: Apple and Google release security updates monthly. If a user doesn't install them, known vulnerabilities remain open.
Malware and Trojans
Malware is malicious software. A trojan is a type of malware that pretends to be a legitimate app. On Android, you can download apps from outside the official Google Play Store — this is called side-loading. Attackers hide trojans inside games, flashlight apps, or battery savers. Once installed, the trojan can:
Steal SMS messages (including two-factor authentication codes)
Record keystrokes
Access your camera and microphone
Send premium-rate text messages
On iOS, side-loading is much harder because Apple controls app distribution tightly. However, sophisticated attacks still exist through enterprise certificates that let companies deploy internal apps. If an attacker steals an enterprise certificate, they can sign malware as if it's a legitimate business app.
Mobile Device Management (MDM)
MDM is a system that companies use to manage and secure employees' mobile devices. Think of it as a centralised control panel that lets IT enforce policies. Key features include:
Enforcing passcode complexity
Remotely wiping a lost device
Preventing installation of unauthorised apps
Pushing security updates
MDM works by installing a profile on the device — a configuration file that tells the OS what rules to follow. For example, a profile might say "the device must encrypt all data" or "you cannot install apps from outside the corporate app store."
MDM Vulnerabilities
Attackers target MDM systems because compromising one MDM server gives them control over hundreds or thousands of devices. Common attack methods include:
Brute-forcing the MDM admin password
Exploiting a vulnerability in the MDM software itself
Man-in-the-middle attacks during the device enrollment process
SMS Phishing (Smishing)
Smishing is phishing via SMS. The attacker sends a text message that says something like "Your package is delayed — track it here" with a malicious link. The link leads to a fake login page that steals your credentials or automatically downloads malware. Mobile users are especially vulnerable because text messages feel more personal than email.
Rooting and Jailbreaking
Rooting (Android) and jailbreaking (iOS) are processes that remove the manufacturer's security restrictions. Users do this to gain full control over their devices, but it also removes critical security protections. A rooted device can run any code, including malware that hides deep in the system. For an ethical hacker, recognising a rooted or jailbroken device is important because it's a major security risk.
Side-Channel Attacks
These attacks don't break the OS directly but steal information by observing indirect effects. For example:
Shoulder surfing: looking over someone's shoulder to see their passcode
Screen recording malware: an app records the screen and sends it to the attacker
Accelerometer-based attacks: analysing sensor data to infer keystrokes
Why does this matter for the CEH exam? The 312-50 exam expects you to know the specific vulnerabilities, attack vectors, and MDM concepts. You'll see questions like "Which attack involves sending a malicious SMS?" (answer: smishing) or "What is the main risk of side-loading apps?" (answer: installing trojans). Understanding these fundamentals is the foundation for the entire mobile security domain.
Identify Attack Surface
List all mobile devices used in the organisation, their OS versions, MDM profiles, and installed apps. The attack surface includes unpatched OS versions, side-loaded apps, and misconfigured MDM settings.
Reconnaissance via Smishing
The attacker crafts a convincing SMS that appears to be from IT support or a delivery service, containing a malicious link. They send it to employees, hoping to trick them into clicking.
Delivery and Installation of Malware
The link either directly downloads a trojan app (side-loading) or redirects to a fake login page that harvests credentials. If the user installs the app, the attacker gains initial access to the device.
Privilege Escalation or Bypassing MDM
The malware attempts to gain higher permissions — reading SMS, accessing corporate email, or disabling MDM controls. On a rooted/jailbroken device, this is much easier because security restrictions are already removed.
Exfiltration and Lateral Movement
Once the malware has access, it sends stolen data (credentials, contacts, files) to the attacker's command-and-control server. From there, the attacker can use those credentials to log into corporate systems from their own device.
Let's place you in the role of a junior security analyst at a mid-sized company called MedicoHealth. MedicoHealth has issued Android smartphones to all 500 field nurses. The company uses an MDM solution called MobileIron to manage those devices. Your boss says, "We've had three nurses report their phones acting strangely — apps opening by themselves, battery draining unusually, and odd data usage. Find out what's happening."
Step one: you log into the MDM console. You see the list of all 500 devices and notice that 47 devices haven't installed the latest security patch from two months ago. That's a vulnerability window. Attackers often exploit known unpatched flaws.
Step two: you check the app installation policy. The MDM policy says only apps from the corporate app store are allowed. But you find that 12 devices have side-loaded a "Patient Log Helper" app that looks suspicious. You pull the app's hash — its digital fingerprint — and search it in a malware database. It matches known trojan code.
Step three: you isolate those 12 devices. The MDM console lets you remotely lock them and perform a factory reset. You also change the MDM admin password because the attacker might have compromised the server itself.
Step four: you interview the nurses who had the infected devices. They all say they received a text message from "IT Support" asking them to install an urgent security update. It was a smishing attack. The link led to the fake app.
Step five: you create a response report. Your findings include:
The specific vulnerability (unpatched OS)
The attack vector (smishing with social engineering)
The MDM configuration flaw (should have blocked side-loading)
The remediation steps (patch all devices, enforce MDM policies, retrain staff)
In a real enterprise, this process happens daily. IT professionals use MDM to:
Enforce encryption on all devices
Require VPN for corporate network access
Block apps from untrusted sources
Remotely wipe devices if they're lost or stolen
Push mandatory security updates
Without MDM, each device is a wild card — no visibility, no control. With MDM, you have a single pane of glass to monitor and protect the entire mobile fleet. The exam expects you to know both the capabilities of MDM and the attacks that try to bypass it.
The 312-50 exam tests mobile platform hacking in several specific ways. Here's what you need to know.
Attack Vectors
The exam loves asking you to identify the correct attack method for a given scenario. Memorise these:
Smishing: phishing via SMS
Side-loading: installing apps from non-official sources
Bluejacking: sending unsolicited messages via Bluetooth
Bluesnarfing: stealing data via Bluetooth
Tethering attacks: abusing a phone's mobile hotspot
MDM Concepts You will see questions about:
The main security features of MDM (remote wipe, password policy, app whitelisting)
The difference between BYOD (bring your own device) and COPE (corporate-owned, personally enabled)
How enrollment profiles work
Why MDM servers are high-value targets for attackers
Common Exam Traps - Trap: They give you a scenario where an app asks for too many permissions. The correct answer is "privilege escalation." - Trap: They describe a device that has a custom ROM (a customised version of Android). The answer relates to rooting. - Trap: They ask which OS is more secure. The exam acknowledges iOS is more locked down, but Android has more documented vulnerabilities because of its open ecosystem.
Specific Terms to Memorise - Jailbreak: iOS — removes restrictions - Root: Android — gains superuser access - OTA update: Over-the-air update — how patches reach devices - BYOD policy: employee uses personal device for work - Containerisation: separating work data from personal data on the same device
Exam Question Patterns - Multiple choice: "Which of the following is a major risk of jailbreaking?" (Answer: it removes OS security features) - Scenario-based: "An employee installs a free VPN app from an unknown website. Later, the company's email app sends spam. What likely happened?" (Answer: the VPN was a trojan that gained access to email credentials) - Matching: You might have to match the attack method (e.g., Bluesnarfing) with its description
What They Don't Test (but beginners think they will) - They don't test specific Android or iOS version numbers - They don't test programming mobile apps - They don't ask for long command-line syntax
Focus on the high-level concepts and the attack vectors. That's where the questions come from. If you can explain smishing, side-loading, and MDM capabilities in plain English, you are well prepared for this section.
Mobile platform hacking exploits vulnerabilities in the operating system, malware delivered via side-loading or SMS, and weaknesses in MDM configuration.
Smishing is phishing via SMS and is a primary attack vector because users trust text messages more than email.
MDM allows remote wipe, passcode enforcement, and app whitelisting, but it cannot prevent physical theft of the device.
Jailbreaking (iOS) and rooting (Android) remove critical OS security protections and should be detected during security assessments.
Side-loading apps from outside official stores is a major risk on Android and can be achieved on iOS using stolen enterprise certificates.
Bluejacking sends unsolicited messages via Bluetooth, while Bluesnarfing steals data — both rely on Bluetooth being left discoverable.
The CEH exam tests specific attack vectors (smishing, side-loading, Bluetooth attacks) and MDM features, not mobile app programming or OS version details.
Containerisation in MDM separates work and personal data on the same device, limiting the damage if an attacker compromises one side.
These come up on the exam all the time. Here's how to tell them apart.
Smishing
Uses SMS text messages as delivery method
Often includes a link that downloads malware or a fake login page
Feels more personal because messages come to the phone directly
Phishing
Uses email as delivery method
Usually contains a link or attachment that steals credentials or spreads malware
Can be filtered by spam filters more easily
Rooting (Android)
Grants superuser (root) access to the Android OS
Often voids warranty and disables some security features
Can be done by software exploits or unlocking the bootloader
Jailbreaking (iOS)
Removes iOS's sandbox and code signing restrictions
Typically done using tools like checkra1n or unc0ver
More difficult because Apple's security is tighter
BYOD (Bring Your Own Device)
Employee uses their personal device for work
MDM profile is limited to work-related data only (containerisation)
Privacy concerns are higher for employees
COPE (Corporate-Owned, Personally Enabled)
Company owns the device, employee can use it personally
MDM has full control over the device, including personal apps
Company bears the cost of the device and the data plan
Side-loading
App is installed from outside the official store (e.g., APK from a website)
No security review by the OS vendor
High risk of installing trojans or malware
Official App Store Installation
App is downloaded from Google Play or Apple App Store
App is reviewed by the vendor's security team (though not perfectly)
Lower risk because of automated and manual scanning
Bluesnarfing
Attacker steals data (contacts, messages, photos) via Bluetooth
Requires Bluetooth to be in discoverable mode
Is an unauthorised data access attack
Bluejacking
Attacker sends unsolicited messages (vCard, text) via Bluetooth
Does not steal data — only sends content
Is more of a nuisance than a data breach
Mistake
Jailbreaking an iPhone makes it more secure because you can install custom security tools.
Correct
Jailbreaking removes Apple's security layers, making the device more vulnerable to malware and exploits.
People see root access as 'freedom' and assume more control equals more security, but the OS security model exists to prevent exactly the kind of attacks jailbroken devices allow.
Mistake
If a phone is encrypted by default, an attacker cannot read any data even if they gain physical access.
Correct
Encryption protects data at rest, but if the phone is unlocked or if the attacker obtains the passcode/pattern, they can access everything. MDM adds an additional layer by enforcing remote wipe.
Encryption is often marketed as a silver bullet, so beginners assume it stops all attacks. They forget that encryption only helps when the device is locked.
Mistake
Mobile Device Management (MDM) can prevent an attacker from physically stealing the phone.
Correct
MDM is software-based and cannot prevent theft. It can only respond after the fact, such as by locking or wiping the device remotely.
The name 'Mobile Device Management' sounds like total control, leading beginners to overestimate its capabilities. Physical security is still the user's responsibility.
Mistake
Side-loading is only dangerous on Android because iOS doesn't allow it.
Correct
Side-loading is officially restricted on iOS, but enterprise certificates and app store review bypasses (e.g., TestFlight) can still be exploited to distribute malicious apps.
Beginners often see the black-and-white distinction and miss the grey areas where sophisticated attackers operate.
Mistake
Bluetooth attacks are old and no longer a real threat because Bluetooth range is very short.
Correct
Bluetooth attacks like Bluesnarfing and Bluejacking still work on many devices, especially if Bluetooth is left discoverable. Long-range Bluetooth devices now exist, extending the attack surface.
People assume short-range technology is automatically safe, ignoring that attackers can be in close proximity and that Bluetooth has evolved.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Rooting is the process of gaining superuser access on Android, while jailbreaking is the equivalent on iOS. Both remove the manufacturer's security restrictions and make the device more vulnerable.
If your phone is locked and you have a strong passcode, the attacker cannot read WhatsApp messages because they are encrypted at rest. But if the phone is unlocked or they have your passcode, they can open WhatsApp and read everything.
MDM is a centralised platform that lets IT enforce security policies on mobile devices — like requiring a passcode, encrypting data, blocking unauthorised apps, and remotely wiping a lost device.
Yes, iPhones can be hacked without jailbreaking through exploits in Safari or iMessage, enterprise certificate abuse, or social engineering that tricks the user into installing a malicious profile.
Side-loading means installing an app from outside the official app store, usually by downloading an APK file. It is dangerous because there is no security review, so attackers can easily hide malware inside fake apps.
Smishing is SMS phishing where the attacker sends a text message with a malicious link or attachment. The message pretends to be from a trusted source, like a bank or package delivery service, to trick the user into clicking.
You've finished Hacking Mobile Platforms. Continue through the 312-50 study guide to build a complete picture of the exam.
Done with this chapter?