Tag: feature | SpinSafe

Android 15 could feature extra security to protect users from shady sideloaded apps

April 25, 2024/in Mobile Security

We’ve been hearing a lot about Android 15 recently, and Google has confirmed that there’s an emphasis on privacy and security in this version of the mobile operating system. Part of that may include extra security features when side loading and installing apps from places other than the Google Play Store.

According to Mishaal Rahman at Android Authority, Android now contains code hinting at something called “Enhanced Confirmation Mode”. While the feature itself isn’t included in the Android 15 beta just yet, it seems it’s designed to improve security surrounding app installation settings and expand upon Android 13’s Restricted Settings feature.

Restricted Settings was designed to limit the capabilities of apps users installed from anywhere other than Google Play. Specifically this stops users from being able to enable Accessibility or Notification Listener services for sideloaded apps — which helps improve data security when the source is unknown.

Enhanced Confirmation Mode will work in tandem with Restricted Settings to deny sideloaded apps access to sensitive data — in case that they come from a malicious source. Specifically it’s designed to prevent misuse of a session-based installation API, which exploits the system Android uses to determine whether an app came from Google Play or not.

Specifically it’s designed to prevent misuse of a session-based installation API, which exploits the system Android uses to determine whether an app came from Google Play or not.

It does this by checking an allowlist in the system settings, checking for an XML file that’s loaded into the factory image. Without this the app won’t be able to bypass these security restrictions and access services like Accessibility or Notification Listener. Any attempts to try will see a specific ECM dialog explaining that these permissions are not available.

However it’s unclear whether there will be an option to exempt certain apps with ECM, as is the case with Restricted Settings. It’s also unclear if well known third party app stores, like Amazon’s, will be exempt from these restrictions.

The ability to sideload on Android is a fantastic one, though it does come with plenty of risks. So…

Source…

USENIX Security ’23 – Black-box Adversarial Example Attack Towards FCG Based Android Malware Detection Under Incomplete Feature Information

January 31, 2024/in Mobile Security

Author/Presenters: Heng Li, Zhang Cheng, Bang Wu, Liheng Yuan, Cuiying Gao, Wei Yuan, Xiapu Luo

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.
Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

*** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored by Marc Handelman. Read the original post at: https://www.youtube-nocookie.com/embed/jRE11W_ZSGI?si=QNu1Ntq_FqLIsNOE

Source…

Chrome Users Will Soon Get This Big Security Feature On Android: All Details

January 17, 2024/in Mobile Security

Google is testing an important privacy feature for Chrome users on Android that mimics the security level set for apps that you use on smartphones.

Over the last few years, Android users get information about the sensors that an app is trying to access on their phone. For instance, when you use Uber, the app will ask for your permission to use location, microphone and even call logs on the device.

Similarly, you have platforms like Zoom or even Google Meet asking for access to the camera on your phone. These access features are coming to Chrome browser now for Android users which was confirmed with the latest Chrome build version 122 recently. What this means is that Chrome users will get similar alerts when a website tries to access the camera, microphone, or even location on their device.

Chrome is probably aware of the specific needs of a website that might be far reaching than what the browser actually wants to access, so giving an extra layer of permission alert will definitely help people understand which website is trying to access what feature on the device. Users will get the option to ‘allow this time’, ‘allow on every visit’ and ‘don’t allow’ for these websites.

Chrome is still testing the feature with its build version on Android so we’re not sure when the public release will be available but going by the timelines, it is likely that we will hear more from Chrome in the coming months when the privacy tool would have gone through thorough tests in the back end. Chrome is used by billions and is the most popular web browser in the market. So, upgrades like these are warranted and it is good to see Google give extra focus to privacy of users, which will surely appeal to more people.

Google tests a ‘Private Space’ feature on Android phones, allowing secure hiding of apps

December 15, 2023/in Mobile Security

For Android smartphones, Google is actively developing a feature called “Private Space” that will allow users to safely conceal apps. This feature, which is expected in a future Android OS update, allows users to hide files and apps from other users, similar to Samsung’s Secure Folder feature that has been around for six years.

This feature, found in the Security & Privacy settings, enables users to create a protected Android user profile using biometrics or a password/PIN. Mishaal Rahman found this development in the Android 14 QPR2 beta. This feature improves privacy when sharing the device by hiding not just the presence of the app but also its notifications.

To preserve the covert use of the “Private Space” feature, Google is thinking of implementing a search bar trigger to reveal these apps.
The possible inclusion of the feature in Android 15 may indicate that smartphone makers will use it more widely, giving more people access to Samsung’s Secure Folder-like features. Rahman points out that not all features were activated in the most recent beta because it’s still in development.

Source…

Tag Archive for: feature