How can you protect your smartphone from being hacked?

According to my experience with individuals, the following measures can reduce the attack surfaces on mobile devices dramatically.

All Mobile Devices:

1. Ensure you’re using the latest mobile operating system version to avoid exposure to known operating system vulnerabilities that were already patched.
2. Enable automatic updates to your apps to avoid exposure to known app security vulnerabilities that were already patched.
3. Use pin-code or app-lock service for restricting unauthorized access to your device and sensitive apps.
4. Avoid connecting to unknown WiFi networks. If you do connect, make sure you’re using a VPN app which encrypts your traffic. This will enable you to avoid Man-in-the-Middle (MitM) Attacks which can compromise your authentication tokens, such as access to gmail account and can also lead to malicious code execution.
5. Turn off low power connectivity communication interfaces when you’re not using them – Bluetooth, NFC, etc. In a similar manner to the previous point, decreasing sensitivity to MitM attacks.
6. Install an app which enable you to locate your device in case of a theft or loss. Make sure it also provides you the capability for a remote data wipe. Some mobiles have these capabilities built in.
7. Do not jailbreak or root your device. While doing so can increase the functionality of your device, it is a prolific ground for hackers as many built-in defenses are not working as they should. In addition, your warranty will go out of the window and high chances you will encounter major difficulties upgrading your operating system version.
8. Install advanced mobile threats protection app – Lookout Mobile Security, Deep Instinct, SkyCure, Zimperium (Keep in mind that I’m not referring to the legacy antivirus solutions which are even less relevant on mobiles). As far as I know, Lookout is the only one offering a consumer version. Please share if you are familiar with other advanced mobile protection solutions available for consumers’ usage :)
9. If you ever receive a message from an unknown source via instant messaging or email with a link - avoid accessing it. It’s rare, but some attacks will start by exploiting vulnerabilities at the operating system once you click the link.

Android Devices:

1. Install apps solely from official app stores to avoid installation of malicious 3rd party market apps:

• Make sure your device is configured not to allow unknown sources. Yes, there are some occurrences of malware infiltrating Google’s application inspection process, but more than 99% of malware are from outside unofficial sources.
• If you do allow unknown sources, do not install an app that was downloaded from an instant message link or a barcode scan.

1. Do not open MMS messages and media from unknown sources. This can be specifically lethal for devices vulnerable to Stagefrieght.
2. Make sure the validate app setting in on for using Google’s known malware detection capabilities.

iOS Devices:

1. Never install or update an iOS provisioning profile or APN configurations. This will allow you to avoid Malicious Configuration Profile attacks which can intercept your entire traffic and local data.
2. Never install applications with developer or demo certificate to avoid malicious apps with a fake certificate which may have malicious intents.

In addition to the above for general security measures:

1. Avoid saving sensitive data on your mobile device.
2. Use guest profile for securing un intended access for others using your phone – kids, friends, etc.
3. When travelling use Sim lock.