Android 17 adds intrusion logging to Advanced Protection
Google adds six features to its hardened mode, including a limit on the accessibility service that banking malware often abuses.
Google announced six new features for Advanced Protection on October 1. It is the optional Android mode that hardens the phone of people who fear a targeted attack, such as journalists or activists. The announcement is on The Keyword, Google's official blog. Most arrive with Android 17, and Google did not say when or on which models a user in Mexico will get them.
What changes for anyone who turns the mode on: apps that use the accessibility service without being verified accessibility tools can no longer do so. That service was built for screen readers and voice control, but it gives broad access to what is shown and tapped on the screen. According to Help Net Security, banking trojans and spyware have exploited it. Other apps will see the notice "Restricted by Advanced Protection".
The log
The newest is Intrusion Logging. It stores security and network events with end-to-end encryption in Google's cloud for 12 months, and it is turned on by hand. The settings screen that Google shows says it includes device connections, app installs and moments when the screen was unlocked. Help Net Security adds that the records cannot be deleted before they expire.
Donncha Ó Cearbhaill, of Amnesty International Security Lab, described it as the first time a consumer mobile platform includes forensic logging built to detect targeted attacks, according to that outlet. The quote was not checked with Amnesty.
The other four
- USB protection: with the phone locked, a new connection stays in charging-only mode. It is for Pixel 6 or later and some Android 17 devices.
- WebGPU: Chrome turns it off in the mode, to reduce the browser's attack surface.
- Failed authentication lock: the device locks after several failed attempts, on selected models only.
- View Supporting Apps: lists which installed apps detect whether the mode is on.
All of the above is Google's account. There is no independent evidence yet that these features stop real malware, and it is not known which models will get each one.
