On the latest I/O 2024 developer convention in California, Google introduced the second beta model of its Android 15 working system — codenamed Vanilla Ice Cream. The corporate additionally gave us a more in-depth take a look at the brand new safety and privateness options coming with the replace.
Whereas the ultimate launch of Android 15 remains to be a number of months away — slated for the third quarter of 2024 — we will already discover the brand new security measures this working system has in retailer for Android customers.
AI-powered smartphone theft safety
Essentially the most vital safety improve (however in no way the one one) is a set of latest options designed to defend in opposition to theft of the smartphone and the person knowledge contained inside. Google plans to make a few of these options accessible not solely in Android 15 but additionally for older variations of the working system (beginning with Android 10) by way of service updates.
First up is manufacturing facility reset safety. To stop thieves from wiping a stolen telephone and rapidly promoting it, Android 15 will allow you to arrange a lock that stops resetting the machine with out the proprietor’s password.
Android 15 may also introduce a so-called “personal house” for apps. Some apps like banking ones or prompt messengers will be hidden and guarded with a further PIN code — stopping thieves from accessing delicate knowledge.
Android 15 will function a “personal house” to cover and defend chosen apps with a separate PIN code
Moreover, Google plans so as to add safety for probably the most crucial settings in case a thief manages to get maintain of an unlocked smartphone. Disabling Discover My Gadget or altering the display screen lock timeout would require authentication utilizing a PIN, password, or biometrics.
However that’s not all: there’ll even be safety in opposition to thieves who’ve snooped on or in any other case obtained the PIN code. Accessing crucial settings like altering the PIN, disabling anti-theft, or utilizing passkeys would require biometric authentication. In response to Google, this settings safety will likely be accessible on some units “later this yr”.
Further anti-theft options in Android
Now let’s speak concerning the new options that will likely be accessible not solely in Android 15 but additionally in variations 10 and above. First, there’s AI-powered, accelerometer-based automated display screen locking. The display screen will routinely lock if the system detects actions attribute of somebody snatching the telephone and rapidly operating or driving away.
Android will routinely lock if it detects motion patterns indicative of smartphone theft
Moreover, the smartphone will routinely lock if a thief tries to maintain it disconnected it from the web for a very long time. Computerized locking will also be set for different conditions — for instance, after a big variety of unsuccessful authentication makes an attempt. Lastly, Android will function distant locking — permitting you to lock the telephone’s display screen from a distinct machine.
Smartphones will also be remotely locked
Safety of private knowledge when display screen sharing and recording
Android 15 additionally focuses on defending person knowledge from scams equivalent to pretend tech-support. Attackers would possibly ask the person to share their display screen (or file their actions and ship a video) and instruct them to carry out harmful actions (equivalent to logging in to an account). This fashion, scammers can receive beneficial data like login credentials, monetary knowledge, and so forth.
First, display screen sharing in Android 15 will (by default) solely share the precise app the person is interacting with, and never the system interface (such because the standing bar and notifications, which could comprise private data). However switching to full-screen sharing will nonetheless be attainable if wanted.
Android 15 will disguise notification content material throughout display screen sharing
Second, whatever the display screen sharing mode, the system will solely show notification content material if the app developer has offered a particular “public model” for it. In any other case the content material will likely be hidden.
Third, Android 15 will routinely detect and conceal home windows that comprise one-time passwords. If a person opens an app window with a one-time password (for instance, Messages) whereas sharing or recording their display screen, the window contents gained’t be displayed. Moreover, Android 15 will routinely disguise login, password, and card knowledge entered throughout display screen sharing.
Throughout display screen sharing, Android 15 will routinely detect and conceal home windows containing one-time passwords
These measures defend not solely in opposition to attackers particularly concentrating on person knowledge, but additionally in opposition to unintentional disclosure of private data throughout display screen sharing or recording.
Enhanced Restricted Settings
We’ve already mentioned the so-called Restricted Settings that Android options from model 13 onward. That is extra safety in opposition to the misuse of two doubtlessly harmful options — entry to notifications and Accessibility providers.
You possibly can learn concerning the dangers related to these options on the hyperlink above. Right here, let’s briefly recall the principle concept of this safety: Restricted Settings stop customers from granting permission to those options for apps not downloaded from the app retailer.
When a person tries to grant harmful permissions to an app downloaded from outdoors the shop, a window titled “Restricted Settings” seems
Sadly, in each Android 13 and 14, this protecting mechanism may be very straightforward to bypass. The issue is that the system determines whether or not an app was downloaded from the shop or not by the strategy used to put in it. This enables a malicious app downloaded from any supply utilizing an “incorrect” technique to subsequently set up one other malicious app utilizing the “appropriate” technique.
Because of this two-step course of, the second app is not thought of harmful, isn’t topic to restrictions, and might each request and acquire entry to notifications and Accessibility providers.
In Android 15, Google plans to make use of a barely completely different mechanism referred to as Enhanced Affirmation Mode. From the person’s perspective, nothing will change — the interface will perform as earlier than. Nonetheless, “underneath the hood”, as an alternative of checking the app set up technique, this mechanism will check with an XML file constructed into the working system containing an inventory of trusted installers.
Merely put, Google goes to hardcode an inventory of protected sources for downloading apps. Apps downloaded from elsewhere will likely be routinely blocked from accessing notifications and Accessibility providers. Whether or not it will shut the loophole, we’ll discover out after the official launch of Android 15.
Defending one-time codes in notifications
Along with the improved Restricted Settings, Android 15 will function extra safety in opposition to apps intercepting one-time passwords when accessing notifications from different apps.
Right here’s the way it works: when an app requests entry to a notification, the working system analyzes the notification and removes the one-time password from its contents earlier than passing it to the app.
Nonetheless, some app classes — for instance, apps of wearables related by way of the Companion Gadget Supervisor — will nonetheless have entry to the total content material of notifications. Due to this fact, malware creators might be able to exploit this loophole to proceed intercepting one-time passwords.
Warnings about insecure mobile networks
Android 15 may also introduce new options to guard in opposition to attackers utilizing malicious mobile base stations to intercept knowledge or spy on smartphone homeowners.
Firstly, the working system will warn customers if their mobile connection is unencrypted — which means their calls and textual content messages may very well be intercepted in plain textual content.
Android 15 will warn about insecure mobile connections
Secondly, Android 15 will notify customers if a malicious base station or specialised monitoring machine is recording their location utilizing their machine ID (IMSI or IMEI). To do that, the working system will monitor requests from the mobile community to those identifiers.
It must be famous that each these capabilities should be supported by the smartphone’s {hardware}. Due to this fact, they’re unlikely to look on older units upgraded to Android 15. Even amongst new fashions initially transport with Vanilla Ice Cream, most likely not all will help these options — it’ll be as much as the smartphone producers whether or not to implement these capabilities or not.
New app safety options
Subsequent up within the Android 15 safety enhancements are enhancements to the Play Integrity API. This service permits Android app builders to determine fraudulent exercise inside their apps, in addition to situations the place the person is in danger, and use numerous extra safety measures in such instances.
Particularly, in Android 15, app builders will have the ability to verify if one other app is operating concurrently with their app and recording the display screen, displaying its home windows on high of their app’s interface, or controlling the machine on behalf of the person. If such threats are detected, builders can, for instance, disguise sure data or warn the person concerning the menace.
Play Integrity API allows app builders to detect malicious exercise and take steps to mitigate threats
Builders may also have the ability to verify if Google Play Shield is operating on the machine and if any identified malware has been detected within the system. Once more, if a menace is detected, the app can prohibit sure actions, request extra affirmation from the person, and so forth.
On-device Google Play Shield
Lastly, one other safety innovation in Android 15 is that Google Play Shield will now function not solely inside the official Google Play app retailer but additionally instantly on person units. Google calls this “stay menace detection”.
The working system (with the assistance of AI) will analyze app habits — specifically, the usage of harmful permissions and interplay with different apps and providers. If doubtlessly harmful habits is detected, the app will likely be despatched to Google Cloud for overview.
“Unsafe app” warning from Google Play Shield
Does this imply now you can ditch your third-party antivirus for Android? Not so quick, tiger. Finally, the effectiveness of anti-malware safety depends upon how completely a vendor can seek for and examine new threats.
Automation is actually essential right here — that’s why we began utilizing machine studying for menace analysis a few years in the past, lengthy earlier than it turned fashionable. However the work of human specialists is equally essential. And on this rating, as quite a few instances of malware infiltrating Google Play display, Google remains to be not doing so nicely — usually missing the sources to unravel this downside.
Due to this fact, we advocate utilizinga complete safety answer on all of your Android units — together with these operating Android 15. It’ll complement completely the brand new privateness and security measures. Furthermore, a lot of what is going to solely be launched within the upcoming replace — for instance the capabilities for theft safety, discovering your machine, or defending particular person apps with a PIN — we carried out a very long time in the past and help even on older variations of Android. Take a look at this detailed overview of probably the most fascinating options in Kaspersky Safety & VPN.
