Latest news with #IntrusionDetection
Forbes
14-05-2025
- Forbes
Google's Best New Update Just Made Android More Like iPhone
All change for Android Getty Images Google's mission to narrow the security and privacy gap to iPhone has just taken a huge step, with confirmation that Advanced Protection Mode will arrive with Android 16. While this 'provides Google's strongest protections against targeted attacks,' and is seemingly targeted at 'users who need heightened security,' the reality is that it turns Android into a device that closely resembles the locked down nature of an iPhone. This one click setting will enable the latest set of theft, fraud and scam defenses within calls and messages, disable higher risk networks, and mandate safe browsing and Play Protect. It also adds the well-publicized inactivity reboot and a USB data cable block aimed at the plague of recent forensic exploits. But the headline act will be to disable sideloading without an option to opt-out. That remains Android's Achilles heel. Some of these settings move beyond iPhone, albeit the browsing and app restrictions lock down a device against the most likely threats a user will face. While Apple's own Lockdown Mode is genuinely extreme, Google's Advanced Protection Mode is more sensible and is well-advised for many Android users to tighten their security. Android will move ahead of iPhone with Intrusion Detection, a new feature Apple should replicate. 'This industry-first feature,' Google explains, 'securely backs up device logs in a privacy-preserving and tamper-resistant way, accessible only to the user. These logs enable a forensic analysis if a device compromise is ever suspected.' Advanced Protection Mode Google Google is also making it easier for sensitive apps — finance, enterprise, comms — to lockdown according to user preferences and device characteristics. 'Advanced Protection acts as a single control point that enables important security settings across many of your favorite Google apps… Advanced Protection will also incorporate third-party applications that choose to integrate in the future.' This is in addition to the newly updated Play Integrity API which draws a line between the no longer supported Android 12 and newer versions of the OS, restricting app behavior for the 50% of Android users running outdated versions of the OS. 'With the release of Android 16,' Google says, 'users who choose to activate Advanced Protection will gain immediate access to a core suite of enhanced security features. Additional Advanced Protection features like Intrusion Logging, USB protection, the option to disable auto-reconnect to insecure networks, and integration with Scam Detection for Phone by Google will become available later this year.'
Android Authority
13-05-2025
- Android Authority
Android 16's new Intrusion Logging feature helps detect if your phone was hacked
Joe Maring / Android Authority TL;DR Google announced Intrusion Logging, a new Android 16 feature to help high-risk users detect if their device has been compromised by hackers. It securely backs up encrypted activity logs (like network info and app installs) to the cloud, accessible only to the user for forensic analysis. The feature uses the new Intrusion Detection API, isn't enabled by default, and requires activating Advanced Protection mode to use. People working in certain fields, such as government, the business sector, or journalism, face a high risk of being targeted by sophisticated hackers. These attackers often go beyond simple phishing tricks, deploying advanced malware that silently compromises a device and its data. To better protect these at-risk users, Google has announced Intrusion Logging, a new security feature in Android 16 designed to help users detect if their device has been compromised. According to Google, Intrusion Logging is an 'industry-first feature' that 'securely backs up device logs in a privacy-preserving and tamper-resistant way.' These logs are 'stored in the cloud using end-to-end encryption,' making them 'accessible only to the user.' If a device compromise is suspected, investigators can perform forensic analysis on these logs to search for suspicious activity. Google's announcement today doesn't provide many details about Intrusion Logging, but we detailed its functions in an APK teardown earlier this month. Intrusion Logging collects 'activity logs' which include details such as USB connection events, network info like Browse history, app installs, Bluetooth connections, lock screen info, and Wi-Fi connections. Your activity logs are encrypted using your Google account password and device lock screen, ensuring that only you can view them. These logs are stored in a 'private and encrypted Google Drive,' providing further protection against unauthorized access. Under the hood, Intrusion Logging makes use of a new API in Android 16 called Intrusion Detection (hence its current in-development name). The API 'collects various device events for off-device investigation of potential device compromise.' It's similar to the network logging feature offered by Android's device administration API used by enterprise management apps, but it does not require device management software and can be used by existing system apps like Google Play Services. Although the Intrusion Detection API is already available in Android 16, Google has yet to integrate it into Google Play Services. Therefore, the Intrusion Logging feature will roll out later this year instead of with Android 16's launch. Because of its target audience, it won't be enabled by default. Enabling Intrusion Logging requires users to turn on the Advanced Protection security mode in Android 16. Got a tip? Talk to us! Email our staff at Email our staff at news@ . You can stay anonymous or get credit for the info, it's your choice.
