Software Hygiene, Safe Browsing, and App Management

In the digital security landscape of Iran, where users face a dual threat of state surveillance and global sanctions, maintaining software hygiene is the first line of defense. "Software Hygiene" refers to the daily habits and practices that keep your device healthy and resilient against attacks.

This guide covers how to safely manage applications when official stores (like Google Play) are restricted, how to browse the web without picking up malware, and how to maintain your operating system to close security loopholes.

---

1. Core Principles of Software Hygiene

Malware often exploits "holes" (vulnerabilities) in outdated software. If you keep your "doors" (software) locked and updated, most attacks will fail.

A. Update Everything, Always

Developers release updates to fix security flaws found by hackers. If you delay an update, you are leaving a known door open.

• Operating Systems: Enable Automatic Updates for Windows, macOS, Android, and iOS.
  • Windows: Settings > Update & Security > Windows Update.
  • macOS: System Settings > General > Software Update.
  • Android: Settings > System > System Update.
  • Linux (Ubuntu): Use the "Software Updater" tool or run sudo apt update && sudo apt upgrade regularly.
• Applications: Enable auto-updates in your app stores. For manual apps (downloaded via APK or .exe), check weekly for new versions.
  • Browser: Your browser (Firefox, Chrome, Brave) is your shield. Restart it frequently to ensure updates are applied.

B. Attack Surface Reduction (Uninstall Unused Apps)

Every app on your phone or computer is a potential entry point for an attacker.

• Audit Monthly: Go through your installed apps. If you haven't used an app in 3 months, uninstall it.
• Remove Bloatware: New phones often come with pre-installed junk. Disable or uninstall what you don't need.

C. Least Privilege (Permissions)

Apps often ask for more access than they need.

• Review Permissions: Go to your device settings (Privacy > Permission Manager) and check which apps have access to:
  • Microphone & Camera: Only communication apps need this.
  • Location: Does a flashlight app need your location? No. Deny it.
  • Contacts/SMS: Malicious apps use this to phish your friends or intercept 2FA codes.

---

2. Safe App Management (The Iranian Context)

Due to sanctions and censorship, Iranian users often cannot access the Google Play Store or Apple App Store directly. This forces users toward third-party markets or direct downloads, which are high-risk vectors for malware.

A. The "Telegram Download" Trap

Critical Warning: A primary method for distributing state-sponsored malware (like "RatMilad" or "Hook") in Iran is via Telegram channels.

• The Scam: Channels promise "Anti-Filter Telegram," "High-Speed VPN," or "Cracked Instagram."
• The Reality: These files often contain Spyware that steals your files, contacts, and 2FA codes.
• Rule: NEVER install an application (.apk, .exe, .msi) directly from a Telegram channel or WhatsApp chat, even if sent by a friend (their account might be compromised).

B. Safe Alternatives to Google Play

If you cannot access Google Play, avoid using insecure local markets if possible. Use these trusted alternatives:

1. Aurora Store (Recommended for General Apps):

   • What it is: An open-source client for the Google Play Store. It lets you download apps anonymously without a Google account.
   • Why it's safer: It pulls files directly from Google's servers, ensuring they haven't been tampered with.
   • Download: Get it from F-Droid.

2. F-Droid (Recommended for Privacy):

   • What it is: A catalog of Free and Open Source Software (FOSS) for Android.
   • Why it's safer: All apps are open-source and audited. It is immune to many commercial trackers.
   • Best for: replacing common tools (PDF viewers, note-taking, QR scanners) with safe alternatives.

3. Obtainium:

   • What it is: An app that tracks open-source projects (on GitHub/GitLab) and updates them directly from the developer.
   • Best for: Getting apps like Signal or VPNs (like V2RayNG) directly from the source code repository.

C. Local Markets (Cafe Bazaar, Myket)

While convenient, Iranian app stores like Cafe Bazaar and Myket have a history of hosting malware and insecure apps.

• Risk: They comply with local laws and may remove secure communication tools (like Signal) or host compromised versions of popular apps.
• Advice: Use them only as a last resort for apps that are only available there (e.g., specific Iranian banking apps). For everything else (WhatsApp, Instagram, browsers), use Aurora Store.

D. The Danger of "Cracked" Software

In Iran, purchasing software is difficult, leading to widespread use of "cracked" Windows and Office versions.

• The Risk: Cracks often come pre-bundled with backdoors or cryptominers. You are voluntarily installing malware.
• The Solution: Switch to Free and Open Source Software (FOSS).
  • Instead of MS Office $\rightarrow$ LibreOffice.
  • Instead of Photoshop $\rightarrow$ GIMP or Krita.
  • Instead of Cracked Windows $\rightarrow$ Linux (Ubuntu/Mint).

---

3. Safe Browsing Practices

Your web browser is your window to the internet—and the primary way threats enter.

A. Browser Choice & Hardening

• Recommended Browsers: Firefox, Brave, or Tor Browser. Avoid using obscure browsers that promise "anti-filtering" capabilities unless verified.
• Extensions (Add-ons): Keep them minimal. Every extension introduces a risk.
  • Must-Have: uBlock Origin. This is not just an ad-blocker; it is a security tool that blocks malicious scripts and tracking domains.
  • Avoid: "Free VPN" extensions (they often steal data) and coupon finders.

B. Analyzing Links (Phishing Prevention)

Before clicking a link, hover your mouse over it (or long-press on mobile) to see the actual URL.

• Typosquatting: Attackers register domains that look real.
  • Real: gmail.com
  • Fake: gmai1.com, gmail-security-alert.com, accounts-google.ir
• URL Shorteners: If you see bit.ly or tiny links, use a tool like CheckShortURL or VirusTotal to see where it leads before clicking.

C. Handling Downloaded Files

If you must download a file (e.g., a PDF invoice or a Word doc), treat it as a "bomb" until proven safe.

1. Check Extension: Enable "Show file extensions" in your OS. Watch out for double extensions like invoice.pdf.exe.
2. Scan with VirusTotal: Upload the file to VirusTotal.com before opening. It scans the file with 60+ antivirus engines.
3. Sanitize with Dangerzone:
   • Dangerzone is a tool that takes a potentially dangerous PDF or Office document and converts it into a safe PDF.
   • It renders the document in a secure "sandbox" and takes pictures of the pages, effectively killing any embedded malware.

---

4. Summary Checklist

5. Emergency Response

If you suspect you have installed a malicious app or clicked a bad link:

1. Disconnect: Turn off Wi-Fi and Mobile Data immediately.
2. Uninstall: Remove the suspicious app.
3. Scan: Run a scan with a reputable mobile antivirus (e.g., Hypatia from F-Droid, or Malwarebytes).
4. Reset: If the device behaves strangely (overheating, pop-ups, battery drain), perform a Factory Reset. This is the only way to be 100% sure the malware is gone.