Google launches new Android security feature to help uncover spyware attacks | TechCrunch

"Android’s Intrusion Logging creates a new type of log, which records errors and collects evidence when something goes wrong with the software, to provide visibility into suspected spyware attacks."

"Until now, forensic analysis has relied on logs that were never designed for intrusion detection. That meant earlier logs were not that useful for researchers, as they did not remain on the device for long and were often overwritten, effectively erasing potential evidence of attacks."

"Advanced Protection Mode is designed to counter government spyware attacks and police forensic devices that try to extract data from a person’s phone. These two types of attacks can also be combined."

"Amnesty International, which worked with Google to develop the feature, called Intrusion Logging “a fundamental shift in the amount and quality of forensic data available on Android devices.”"

Android is rolling out an opt-in feature called Intrusion Logging within Advanced Protection Mode. Advanced Protection Mode is designed to make devices harder to hack and to counter government spyware attacks and police forensic tools that extract data from phones. Intrusion Logging creates a new log type that records errors and collects evidence when software problems occur, aiming to provide visibility into suspected spyware attacks. Amnesty International worked with Google to develop the feature and described it as a shift toward higher-quality forensic data. Amnesty noted that prior forensic analysis relied on logs not designed for intrusion detection, which were often overwritten or removed quickly, reducing the usefulness of evidence. Technical limits previously made deep analysis of system logs and files harder on Android than on iOS.

Read at TechCrunch