Google Unveils Android Feature to Help Uncover Spyware Attacks

Google is rolling out a new opt-in feature in Android that aims to help security researchers investigate spyware attacks. The feature, called "Intrusion Logging," is part of Android's Advanced Protection Mode, an opt-in special security mode designed to make the device harder to hack.

Advanced Protection Mode is designed to counter government spyware attacks and police forensic devices that try to extract data from a person's phone. These two types of attacks can also be combined. In at least one documented case in Serbia, authorities used a law enforcement forensic tool made by Cellebrite to unlock a device, and then installed spyware as a further step to continue monitoring the target.

The rollout of Intrusion Logging is the first time a phone maker has launched a feature with the goal of helping security researchers investigate spyware attacks. To achieve that, Android's Intrusion Logging creates a new type of log, which records errors and collects evidence when something goes wrong with the software, to provide visibility into suspected spyware attacks.

• Intrusion Logging creates and collects logs once a day and stores them encrypted in a user's Google account in the cloud.
• The logs are also encrypted so that only the user can access and share the logs with investigators, and Google cannot access them.

In the event of a spyware attack, these logs can help investigators understand when and how authorities may have hacked or forcibly unlocked someone's device and connected it to a forensics tool, or used to install spyware or stalkerware. The logs can also determine if a phone at some point connected to a malicious website that tries to hack the visiting device, or accessing servers designed to extract data from the phone.

While it is a step forward, Intrusion Logging has some limits. For now, along with having to enable Advanced Protection Mode, the feature requires Android's latest software version, is only available for Google-made Pixel devices, and that the device has to be linked with a Google account.

In a blog post, Amnesty International, which worked with Google to develop the feature, called Intrusion Logging "a fundamental shift in the amount and quality of forensic data available on Android devices." Donncha Ó Cearbhaill, the head of Amnesty's Security Lab, told TechCrunch that Android's technical limits "have made it difficult to deeply analyze system logs and files for signs of compromise, unlike with iOS.\