Android 17 Adds OS-Wide ECH Privacy

Google announced new network security protections in Android 17 on Thursday. The update aims to bolster connection privacy and address cellular vulnerabilities.

Topping the list is system-wide support for Encrypted Client Hello (ECH). This privacy standard prevents networks from eavesdropping on which websites a user visits.

"This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you," Google's Bram Bonné and Shuaibo Huang said. By encrypting the destination website name from the start, ECH ensures network providers and snoopers cannot easily see which sites or apps are being accessed.

In a parallel report, Google's Jigsaw division detailed the integration. ECH hides the domain name using a secret encryption key that only the destination website can decipher.

"Critically, though, not all web servers will offer ECH support," Jigsaw noted. To avoid exposing only certain connections as protected, apps and browsers should use ECH GREASE. This technique sends fake, randomized ECH extensions to sites that don't support ECH, making every connection request look identical.

With Android 17, ECH GREASE will be enabled by default. ECH was previously integrated into Google Chrome version 117 and Mozilla Firefox version 118. The Android 17 update expands this protection to the entire operating system.

Jigsaw also said OkHttp, an open-source HTTP client, has integrated ECH support into its core library. This allows third-party Android app developers to leverage the new capability.

Enhanced Local and Cellular Protections

Beyond ECH, Google has enforced Local Network Protection in Android 17. This requires apps to ask for user permission before they can scan or connect to other devices on the local network.

The update introduces two other key features. Certificate Transparency (CT) is now enabled by default, mandating that all websites be logged in a public registry. Furthermore, it allows telecom operators to turn off 2G by default for their subscribers.

Disabling 2G aims to prevent downgrade attacks and mitigate exposure to rogue base stations. It also guards against SMS blasters that can send malicious text messages or capture traffic from nearby devices.

Android 12 included a manual option for users to disable 2G at the hardware level. Android 14 added a feature letting IT administrators turn off 2G support in managed devices. The Android 17 offering is a zero-click solution for participating carriers.

"For participating carriers, this helps eliminate the legacy attack surface out of the box," Google said. It proactively mitigates a primary method used by SMS blasters before they can target a device.

The source for this report is The Hacker News.