Android Adds Intrusion Logging for Sophisticated Spyware Forensics

Key Points:

• Google has introduced Intrusion Logging, an opt-in Android feature within Advanced Protection Mode, designed to store encrypted forensic logs of device and network activities to help investigate sophisticated spyware attacks.
• Developed with Amnesty International and Reporters Without Borders, the feature logs app activity, network connections, file transfers, system changes, and device lock/unlock events, with logs encrypted end-to-end and stored securely for 12 months.
• Intrusion Logging records network events even during Chrome Incognito browsing, potentially revealing visited websites, and once enabled, logs cannot be deleted before expiration, though users can download and manage them offline.
• Additional Android security enhancements include verified financial calls to prevent phone call spoofing, expanded Live Threat Detection for suspicious app behavior, improved device recovery options, and new privacy controls for location and contact sharing.
• Google also announced broader security upgrades such as post-quantum cryptography, hardware-backed AI data isolation, scam detection for chat notifications, and better protections against banking scams, reinforcing Android as a secure platform.