I want to use my Samsung Galaxy Trend Plus as a mobile hotspot, for my laptop. I have installed a custom ROM on the phone -- Official Lineage OS 14.1. There are no security updates for this OS. Does this mean that the mobile hotspot connection is unsafe, or is the Wi-Fi security independent of the OS? Does it matter, as long as my laptop's OS is up to date and using a VPN?
Android releases frequent Security Bulletins to address a number of vulnerabilities at operating system and hardware level. So as a thumb rule, the newer the better and safer. But if you just want to use hotspot, it's not very hard to enforce the basic security measures.
Using as hotspot means your phone is working as a router. Routers do have builtin firewalls for better protection, and some advanced features like Port Forwarding, DMZ, UPnP, QoS, VPN, multiple AP's, RADIUS, NTP, DHCP server, DNS server, Dynamic DNS, VoIP features (SIP ALG and others), captive portal, traffic sniffing / DPI, anti-malware etc. A normal Android phone offers some of these features out of the box; the basic NAT,
netfilter (iptables) firewall, Access Point (AP) with WPA2 encryption and a DHCP/DNS server.
Additionally if you are a tech-savvy, you can also define your own firewall rules, port forwarding rules, setup a VPN etc. A few things I can think of which can be easily done:
- Android uses
dnsmasqas DHCP and DNS server. You can edit /etc/dnsmasq.conf to whitelist you MAC/IP addresses by assigning fixed IPs to MACs (options
dhcp-range=) so that only your configured devices get an IP from DHCP server.
dnsmasqto listen only on local network interface and not from internet facing interface.
- Android uses
hostapdto create hotspot. Configure MAC filter in hostapd.conf (options
accept_mac_file) so that none other can connect to your phone.
hostapdto offer at least
WPA2 PSKencryption (option
hostapdto hide SSID (option
- Configure at least 12 character long
Pre-Shared Key (PSK)(option
- Run a DNS over HTTPS (DoH) server like dnscrypt-proxy. Or at least set DNS server in
server=) to some trustworthy public DNS like
dnscrypt-proxyblacklist file from some trustworthy source like this one to block ads and harmful websites.
- Make sure you don't have any listening ports (by executing
ss -ltup) except
dnsmasq's port 67 (DHCP) and 53 (DNS).
- Make sure you don't have any port forwarding rules defined (by executing
iptables -S FORWARD) except the one defined for
- Block all incoming new packets. See this.
- Disable ICMP echo reply. See this.
- Block all non-root UIDs for
OUTPUTchain (except if
hotspotuses some non-root UID) to ensure no apps use any data.
- Also consider allowing only required destination ports like 80, 443 if you need to do only web browsing. Allow others like SIP/RTP/FTP/SFTP/SMB etc. if needed.
- Uninstall all user apps to save battery and internet traffic.
- Disable any system apps you find unnecessary, particularly GApps, cleaners, system optimizers, anti-malware etc.
Still if you enjoy playing with phone, consider setting up some router operating system like Zeroshell on your phone.
But even if you don't take any extra measures on phone, laptop's security is enough (for laptop) if configured properly.