Abstract: Trap data is stored in a mobile computing device. A lightweight engine monitors outgoing communications in the mobile computing device for the trap data. Data leakage is deemed to have been detected in the mobile computing device when an outgoing communication includes the trap data. A cloud service hosted by a backend system may also be monitoring for the trap data. In the case where the trap data is a trap e-mail address, the cloud service may monitor for an e-mail that is addressed to the trap e-mail address. In response to receiving the e-mail, the cloud service may consult a database to determine that the trap e-mail address is stored in the mobile computing device. Receiving the e-mail indicates that data leakage is occurring in the mobile computing device.

Abstract: A low resource mobile device, such as a smart phone or a tablet running a mobile operating system, requests a cloud computer system to inspect a mobile application for malicious content. The cloud computer system downloads the mobile application from a mobile application source, and installs the mobile application in a virtual machine sandbox. The cloud computer system inspects the mobile application for malicious content while the mobile application executes in the virtual machines sandbox. The result of the inspection is sent to the user in accordance with a setting that may be indicated in a cloud sandbox agent running on the mobile device.