Google talked about new measuresMeasures taken to protect network functionality in Android 17. Features such as encrypting the domain names of websites visited by users, increasing the security of local connections, strengthening certificate verification, and operators can disable 2G networks by default have appeared.
Image source: blog.google
By default, HTTPS encrypts transmitted data, but the server name can currently only be transmitted in clear text when establishing a connection. Therefore, the operator or owner of a public Wi-Fi network can determine that the user is connected to example.com, even though he does not see the specific opening page and its content. This data can be used to create user profiles that attackers can use for targeted phishing and fraud campaigns.
To address this issue, Android 17 gets support for Encrypted Client Hello (ECH) technology, which works in conjunction with Private DNS to allow you to hide a website’s domain name during the connection setup phase. Therefore, for supported sites and applications, it becomes more difficult for operators and other observers to determine which resources users are accessing. To implement the new technology, Google recommends that application developers update to the OkHttp 5.5.0 library and enable ECH.
Operators can now deactivate subscribers’ 2G networks by default. This will help protect against attacks using so-called text blasters, fake cell towers that use powerful signals to force nearby smartphones to turn off LTE or 5G and switch to less secure 2G networks. The attacker can then bypass modern mechanisms that filter out spam and scam messages and send phishing messages directly to potential victims.
Protection of local connections has been enhanced: applications will ask for permission before scanning the local network or connecting to other devices on the local network. Not only does this prevent malicious apps from searching for vulnerable devices on home networks, but it also makes it difficult to covertly track users through a group of detected routers, TVs, and other devices. At the same time, for common scenarios such as selecting a TV to play videos, Android will provide a system interface that does not require the application to have full access to the local network.
Finally, Android 17 enables credential transparency checking by default. TLS credentials issued to websites should be recorded in public logs so that systems can detect suspicious or incorrectly issued credentials. This enables you to identify incorrectly issued certificates and significantly reduces the likelihood that attacks using them will go undetected.
If you find an error, select it with your mouse and press CTRL+ENTER.