Google launches new Android security feature to help uncover spyware attacks

In a significant move to bolster user security, Google has launched a new opt-in feature for Android devices designed to assist security researchers in detecting and investigating spyware attacks. Dubbed "Intrusion Logging," this feature is part of the Advanced Protection Mode, which was initially introduced last year to enhance device security against hacking attempts. Intrusion Logging aims to fortify defenses against government-grade spyware and forensic tools that can extract sensitive data from smartphones. Notably, there have been documented instances, such as in Serbia, where law enforcement utilized advanced forensic tools to unlock devices before deploying spyware for ongoing surveillance. This new feature marks a pioneering effort by a smartphone manufacturer to provide tools that enhance investigative capabilities regarding spyware. The functionality of Intrusion Logging involves creating detailed logs that document software errors and other anomalies that could indicate a spyware attack. This initiative received strong backing from Amnesty International, which emphasized that the new logging system represents a transformative advancement in the quality of forensic data accessible on Android devices. Previously, the logs available for forensic analysis lacked the specificity needed for effective intrusion detection, often leading to the loss of critical evidence. Donncha Ó Cearbhaill, head of Amnesty’s Security Lab, highlighted the challenges that Android's technical limitations have posed in the past, making it difficult to effectively analyze system logs for signs of compromise. With the introduction of Intrusion Logging, the potential for identifying spyware attacks is expected to improve significantly. Although Google first announced this feature a year ago, it is now being rolled out to devices updated with Android 16 and later. Intrusion Logging operates by generating daily logs that are securely stored in the cloud, encrypted to ensure that only the user can access or share them with investigators. This is particularly important as it helps safeguard evidence from being erased by potential spyware. The feature meticulously tracks various security events, including phone unlocks, app installations and deletions, and connections to external servers. It can also detect attempts to delete logs, which could indicate efforts to conceal evidence of an attack. While Intrusion Logging represents a substantial step forward, it does come with certain limitations. Currently, it is only available for Google Pixel devices and requires users to enable Advanced Protection Mode, along with linking their device to a Google account. This feature is targeted primarily at individuals who may be at risk of being targeted by spyware, such as human rights advocates, activists, and journalists. In comparison, Apple has also implemented similar protective measures through its Lockdown Mode, which has proven effective in preventing successful spyware attacks. As both companies continue to enhance security measures, the focus remains on protecting vulnerable individuals from invasive surveillance tactics. Amnesty International has provided detailed instructions for users on how to access their logs if they suspect they have been targeted by spyware, reinforcing the collaborative effort to combat digital threats effectively.