TL;DR
- Android 16 is including a brand new safety characteristic that may warn you when your telephone may be linked to a faux or insecure cellular community created by a “stingray” gadget.
- This characteristic alerts you to unencrypted connections or when the community requests your telephone’s identifiers, which might help detect when surveillance may be taking place.
- Attributable to new {hardware} necessities, this safety will possible solely be on new gadgets launching with Android 16, such because the upcoming Pixel 10.
There are a lot of easy issues you are able to do to maintain your non-public data secure, like utilizing robust passwords, scrutinizing app permissions, and solely putting in apps from trusted sources. Nevertheless, some assaults are a lot more durable to guard your self in opposition to, as they’re so subtle and stealthy that they will occur with out you ever noticing. One such assault tips your telephone into connecting to a faux, insecure cellular community, which is tough for the common particular person to detect. Thankfully, the brand new Android 16 replace has a characteristic that may be capable to warn you when somebody is utilizing this tactic to eavesdrop on you.
This sort of assault makes use of a tool referred to as a “stingray.” An attacker units up this gadget close to a goal they wish to surveil, and it mimics a respectable cell tower. The stingray tips close by cellular gadgets into connecting to it, permitting the attacker to gather distinctive identifiers (just like the IMEI) and even power them onto an older, extra insecure communication protocol. These identifiers enable attackers to focus on particular gadgets for evaluation, whereas switching protocols can allow them to intercept unencrypted textual content messages and telephone calls.
These “stingray” gadgets are notoriously utilized by legislation enforcement companies, however their know-how may also be acquired by malicious actors. Whereas some argue they’re a obligatory device for surveilling criminals, their potential for abuse is critical, as they can be utilized to covertly accumulate knowledge on odd folks. Due to this, Google has been engaged on methods to warn Android customers or forestall them from sending communications over insecure mobile networks.
With the discharge of Android 12, for instance, Google added assist for disabling 2G connectivity on the modem degree. In Android 14, the corporate adopted up by supporting the disabling of connections that use null ciphers — a type of unencrypted communication. Extra not too long ago, Android 15 added assist for notifying the OS when the community requests a tool’s distinctive identifiers or tries to power a brand new ciphering algorithm. These options instantly counter the ways utilized by business “stingrays,” which trick gadgets into downgrading to 2G or utilizing null ciphers to make their site visitors simpler to intercept. Blocking these connections and notifying the person about these requests helps defend them from surveillance.
Mishaal Rahman / Android Authority
The toggle to disable 2G networks in Android 16 on a Pixel 9a.
Sadly, solely certainly one of these three options is broadly out there: the power to disable 2G connectivity. The issue is that implementing these protections requires corresponding adjustments to a telephone’s modem driver. The characteristic that notifies the OS about identifier requests, for instance, requires a modem that helps model 3.0 of Android’s IRadio {hardware} abstraction layer (HAL). This dependency is why these safety features are lacking on present Pixel telephones and different gadgets, and it’s additionally possible why Google delayed launching the devoted “cellular community safety” settings web page it deliberate for Android 15.
Since upcoming gadgets launching with Android 16 will assist model 3.0 of Android’s IRadio HAL, Google is reintroducing the “cellular community safety” settings web page within the Security Heart (Settings > Safety & privateness). This web page incorporates two subsections:
- Notifications
- This subsection incorporates a “Community notifications” toggle. When enabled, it permits the system to warn you in case your gadget connects to an unencrypted community or when the community requests your telephone’s distinctive identifiers. This toggle is disabled by default in Android 16.
- Community era
- This subsection incorporates a “2G community safety” toggle that allows or disables the gadget’s 2G connectivity. This is identical toggle present in the primary SIM settings menu, and it’s also disabled by default in Android 16.
The “Cellular community safety” web page will solely seem on gadgets that assist each the “2G community safety” toggle and the “community notifications” characteristic. That is why it doesn’t seem on any present Pixel gadgets working Android 16, as they lack the required modem assist for the community notifications characteristic.
When the “Community notifications” characteristic is enabled, Android will put up a message within the notification panel and the Security Heart at any time when your gadget switches from an encrypted to an unencrypted community, or vice versa. It can additionally put up an alert in each locations when the community accesses your telephone’s distinctive identifiers, detailing the time and variety of occasions they had been requested.
It’s price noting that respectable mobile networks do must entry your gadget’s distinctive identifiers every so often, resembling when your gadget reconnects to them after exiting airplane mode, so the community notifications don’t show malintent. Android has no method of really understanding whether or not a cell tower is actual or not, so it’s merely offering discover to the person and letting them resolve whether or not they need to take motion.
Now that Google has relaunched this safety web page in Android 16, it gained’t be lengthy earlier than we begin seeing it on gadgets. Nevertheless, because of the Google Necessities Freeze (GRF) program — a coverage that permits OEMs to lock in hardware-related necessities for gadgets at launch — it’s unlikely that any present gadgets will likely be up to date to assist the notifications characteristic. We are going to almost certainly have to attend for upcoming gadgets that launch with Android 16, such because the Pixel 10 sequence, to see this safety totally applied.
This text was up to date at 6:04 PM ET to make clear that Android’s “community notifications” don’t function true indicators that the gadget is definitely linked to a faux cell tower, however moderately as warnings to the person that this could possibly be taking place.
