24 ms·
Android 14 introduces cellular connectivity security features
- smallnix 3y agoIs this about more than letting my company disable 2G on my phone?
- stonogo 3y agoThey dropped null ciphers as well, but that only got a brief mention in comparison.
- deleted 3y ago[deleted]
- debatem1 3y agoThere's been a setting for users to disable 2G for forever, so the new parts of this are null ciphers and enterprise control. Getting rid of null ciphers is good though. It would be nice to also refuse weak, export, etc ciphers.
- Narkov 3y ago> There's been a setting for users to disable 2G for forever, I don't think this setting does what you think it does. The description under this option has a big caveat: "For emergency calls, 2G is always allowed". So even when disabled, the phone can still use 2G networks. It sounds like this new option is to actually disable all 2G functionality.
- trehalose 3y agoIf a phone is already compromised to the point it can make emergency calls without the user intending it to, how helpful is it for the user to have disabled 2G?
- tialaramex 3y agoNo, the new option in this respect is to let corporates choose "No, never" for employee devices. Previously (e.g. Android 13) if your cellular provider said you can choose "No" then there's a slider in your Settings so you can choose, otherwise it's greyed out and tells you "Name of Your Provider requires 2G to be available". On corporate devices it's a pain to have settings that your users can screw up, and so it's nice when Android (or Apple for iOS) makes the setting something you can choose to lock down instead. # Edited to correct text of fixed message when your cellular provider has decided you mustn't switch off 2G.
- ploxiln 3y agoI just went and checked this option on my phone; Google Fi requires 2G to be available! seriously Google?
- debatem1 3y agoMy fi phone does not require this. I suspect it is down to the baseband rather than the manufacturer or carrier.
- seizethegdgap 3y agoFi uses T-Mobile, so it would make sense that TMO MVNOs would also have to have 2G enabled.
- debatem1 3y agoThe new feature (and underlying HAL) both explicitly allow the radio to ignore restrictions on network types when making emergency calls, so this is not the distinction being drawn. There is also nothing the OS can do to shut down 2G in most cases; the best it can do is ask nicely that the baseband does not use it. So the "shut it all down" theory is also not correct.
- numpad0 3y agoEmergency call works slightly differently to normal calls, in particular, it could start with the phone completely disconnected from the tower. So specifically emergency call being available in 2G doesn’t mean the phone still registers on 2G. It’s probably a legal requirement that if 2G is supported emergency calls on 2G must be also supported. Maybe there are some LTE-3G dualmode phones without GSM in the world, if that’s what you must have?
- kiwijamo 3y agoMy Samsung S21 running the latest Android (13) doesn't offer the option to disable 2G while keeping 4G/5G. The list is literally: 2G/3G/4G/5G, 2G/3G/4G, 2G/3G, 3G only, or 2G only. If you want to keep 4G and/or 5G you're SOL. Personally, I would prefer 4G/5G (as the 2G/3G fallback on my network next to useless outside the 4G/5G coverage footprint). Hopefully when Android 14 comes to the S21 it comes at least the option to disable 2G as described in the article.
- notatoad 3y agois this a carrier limitation? IIRC there used to be something about verizon requiring a 3G authentication step to connect to their 4G network
- numpad0 3y agoEarly releases of LTE just didn’t have a spec for voice call, so the phone would disconnect and reconnect in 3G when a call was happening(circuit switched fallback). Maybe that one?
- ProtoAES256 3y agoCan you change it in ##4636## though?
- ndesaulniers 3y agoWhat the magic hell is ##4636##?
- Xeamek 3y agoMMI (man machine interface) codes. Some of them are dictated by telephony standards, some by carriers and some (probably most popular) by device manufacturers. Basically they let you access various features and settings
- zekica 3y agoIt is actually star pound star pound 4 6 3 6 pound star pound star. 4636 represents INFO.
- supertrope 3y agoIt's the right trade off for most people as the only USA 2G nationwide network is T-Mobile's. They are going to turn it off in April 2 2024 (1). There's some regional carriers in rural areas that offer the only coverage available. Like Commnet Wireless (2). These are few and far between and usually they have deployed 3G to their whole footprint. The Big Three are building out native coverage to overlap with them. But by Murphy's Law someone with an Android 14 phone is going to discover that they can't call anything but 911. Ideally there would be a button prompt enabled in No Service situations to re-enable 2G. FCC rules mandate that cellphones must support fallback to null cipher if that's what's needed to connect an emergency call. (1) https://www.t-mobile.com/support/coverage/t-mobile-network-evolution https://www.t-mobile.com/support/coverage/t-mobile-network-e... (2) https://www.cellularmaps.com/regional-carriers/commnet-wireless.shtml#GSM https://www.cellularmaps.com/regional-carriers/commnet-wirel...
- xxpor 3y agoGiven you can get a relatively fast 4G connection in Deadhorse, AK (https://www.google.com/maps/place/Deadhorse,+Prudhoe+Bay,+AK+99734/@70.2002029,-148.4648689,16z/data=!3m1!4b1!4m6!3m5!1s0x512077009926947f:0x1d228d1ae7281c59!8m2!3d70.2001996!4d-148.4597191!16zL20vMDZ0XzU3?entry=ttu https://www.google.com/maps/place/Deadhorse,+Prudhoe+Bay,+AK...), it's pretty crazy that there's still places with 2G only connectivity anywhere in the US.
- hobs 3y agoPlenty of places I still get no service at all in northern Minnesota.
- bombcar 3y agoWi-Fi calling has been a godsend in the rural Midwest, as you can at least make calls at home.
- zoklet-enjoyer 3y agoNorth Dakota too. There's a dead spot between Grand Forks and Devil's Lake. That used to sketch me out when I would drive home for Christmas. I was somewhere between Hazen and Bismarck recently and had no signal.
- excusemyfrench 3y agoNot true, disabling 2G is already present in iOS in Lockdown Mode.
- olyjohn 3y agoWhy shouldn't you be able to disable 2G in normal mode?
- mjg59 3y agoDisabling 2G has been supported in Android since 12 - this is talking about the additional features on top of that.
- kiwijamo 3y agoSeems to be up to the manufacturers and/or the carriers. Samsung doesn't have this for example even on my S21 running Android 13.
- smarx007 3y agoHow? iOS 17 is not released yet.
- clysm 3y agoLockdown mode is iOS 16.
- smarx007 3y agoI think the Lockdown Mode will disable 2G only starting with iOS 17. The press release [1] doesn't mention 2G directly but only "safer wireless connectivity defaults" but FastCo [2] is more direct "with iOS 17, Apple is not only beefing up Lockdown Mode (by blocking the iPhone from connecting to 2G cellular networks and from auto-joining insecure wireless networks) but bringing Lockdown Mode to the Apple Watch". [1]: https://www.apple.com/newsroom/2023/06/apple-announces-powerful-new-privacy-and-security-features/ https://www.apple.com/newsroom/2023/06/apple-announces-power... [2]: https://www.fastcompany.com/90904197/apple-ios-17-craig-federighi-privacy-check-in-lockdown-mode-safari https://www.fastcompany.com/90904197/apple-ios-17-craig-fede...
- b112 3y agoLook forward to samsung disabling this, just like they do for other android cellular settings.
- hermitdev 3y agoThe disable 2G switch is available on my Samsung running Android 13. Maybe your carrier is doing it to you?
- b112 3y agoCan you disable 5G? I can't, and it causes endless issues here. Lots of stock android controls are hidden, and it doesn't seem to be a carrier thing.
- kiwijamo 3y agoMy Samsung S21 running Android 13 doesn't have this option. My carrier is One NZ but from what I understand it's just stock Samsung firmware/software without anything specific to my carrier. Curious what Samsung phone you have, I wonder if it's only available on the more recent models.
- Xeamek 3y agoYou don't need custom carrier firmware, some configs are downloaded from carriers whenever your device registers in the network. Those settings are one of them.
- TheRealPomax 3y agoAnd then you put stock Android on it, because no one wants Bixby.
- windowsrookie 3y agoI may have to get rid of my Samsung phone because of this. There is no way to turn off 5G or 5G UW. I often find myself in an area where the phone will cling on to 1 bar of 5G UW and it's unusable with websites refusing to load. On an iPhone you can just turn off 5g and fall back to LTE. On this Samsung phone my only option is to physically move to another location which is unacceptable.
- jchw 3y ago> We look forward to discussing the future of telco network security with our ecosystem and industry partners and standardization bodies. We will also continue to partner with academic institutions to solve complex problems in network security. We see tremendous opportunities to curb FBS threats, and we are excited to work with the broader industry to solve them. I'll be honest. The stuff in this article is good, if a little underwhelming, but I feel a large amount of distrust for Google nowadays, to the point where what would've felt like unnecessary pessimism now feels only rational to me. Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. How long until carriers try to limit devices that don't support Google Play or Apple remote attestation of some kind? I don't know what to think or do anymore.
- esafak 3y agoGoogle is a large company. One part can do good while another part does bad. It's not as if anybody thinks Pichai is directing it all with any success :)
- coldtea 3y agoGoogle is a profit-seeking machine who has long shed any "startup" stage principles ("don't be evil" and such) as luxuries. Even the parts that do good feed the parts that do bad.
- szundi 3y agoAgreed
- surajrmal 3y agoCompanies have many incentives and they play out in different ways. It's possible to have that result in some things that you think are good and some which you don't. At a certain size, there is no longer a unified set of values holding everything together and inevitably, some values will clash with yours. Lumping everything into one pile is dramatic.
- nimbius 3y agoI think the biggest reveal I see in the article is that the lynchpin of stingray is basically an overpriced downgrade attack. Disabling 2g is arguably a potent way for ma bell to keep security companies like stingray from eating their already opulent lunch. We also dropped 2g because stingrays parlour trick also immediately outed itself as a national security threat
- fullspectrumdev 3y agoIs that a reveal? The downgrade attack has been common, public knowledge since at least the early 2010’s.
- b8 3y agoATT already killed 3G devices, and there's Android apps that claim to detect stingray/fake towers. However, this is still a good move on Google's end.
- secondcoming 3y ago> In other words, the network decides whether traffic is encrypted and the user has no visibility into whether it is being encrypted. I'm pretty sure that it was intended that the OS UI would show you when your connection is unencrypted, but none of them do because that was undesired by state actors. Also, even if encryption is enabled it's only for the radio part of the data transmission, not handset -> handset. Otherwise you would not be able to make calls to landlines, so isn't it already trivial for a Network Operators to decrypt your raw data? It would help for scenarios like an embassy mounting a fake base station to grab data about protestors outside it, I suppose. Also, how can they tell if the encryption key is weakened by setting lots of bits to zero, like was done in the original version of GSM?
- Scene_Cast2 3y agoI hope that they didn't make it any more difficult for me to MITM my own phone traffic. The latest Android releases have a couple of painfully annoying methods. The one I did (simplest, IMHO) requires rooting, installing a (somewhat obscure) Magisk module, and several more steps after. Not a fun experience, and I signed up for Android and not iOS because I want to be able to do stuff like that.
- TechBro8615 3y agoYou might be able to MITM some packets meant for the cellular network, but fundamentally you're not gonna be able to MITM any cellular packets without running your own base station (i.e. a device outside your phone). Whatever mechanism you used for redirecting cellular traffic to your MITM apparatus could always be bypassed by simply sending that traffic over the actual cellular network.
- gareth_untether 3y agoIt’s typical of Unity to announce something cool sounding and not link to more in depth articles on how to use the stuff.
- kindawinda 3y agohaha Google really is trying to copy Obsidian Intel again. last time wasnt so blatantly obvious. https://shop.obsidianintel.com/products/obeliskone-executive-secure-phone https://shop.obsidianintel.com/products/obeliskone-executive...
- salad-tycoon 3y agoSo this is an NSA/they phone, right? Or what do those in the field think? Also it has covert video? I’m sticking with my iPhone mini 12.
- mistercheph 3y ago[flagged]
- alberth 3y agoDoes this help prevent scammers from calling me or spoofing someone else’s phone #? If not, it’s way less interesting.
- nani8ot 3y agoGrapheneOS implements a similar feature which limits to 4G cellular networks. This is great if the phone decides 3G or 2G connectivity is better, but I know the 4G network is faster (still slow). A downside is that if the 4G network is completely overwhelmed (e.g. on a festival), the phone might not receive phone calls or sms it'd receive if it could switch to 2G (happened to me. The phone had 4G connectivity, but SMS didn't work without allowing 2G).
- philsnow 3y ago> Most notably, 2G networks based on [...] (GSM) standard lack mutual authentication, which enables trivial Person-in-the-Middle attacks. Missed opportunity to call them Mal-in-the-Middle attacks.
- jaimex2 3y agoI feel like this could have been a bullet point at the bottom of the release page. 2G is long dead.
- 310260 3y agoIt just isn't at all. It's still on-air in the US and much of Europe not to mention huge countries like India (where it is still heavily used) and China plus many African countries.
- jonathantf2 3y agoNot at all - I regularly get 2G/EDGE signal, less 3G but still some of that too.
- xvilka 3y agoIt's hard to imagine how they going to achieve this given that ultimately it's controlled by the closed source baseband code that's not written by Google.
- 310260 3y agoThere are only so many partners for cellular basebands in Android phones realistically. Qualcomm, MediaTek, and Samsung make up the vast majority of that market. Google already cooperates with them for other work I'm sure. No reason they wouldn't want to implement this.
- major4x 3y agoGoogle helping with your security is similar to when those nice mafia guys knock on your door offering protection. Don't forget that Google is apotheosis of evil corporation trying to take over all your data. This is the very company that turned "don't do evil" into "do things".
- kaba0 3y agoIt's almost like a giant company like Google have ~100,000 employees, with a complex incentive structure at different levels that are encouraged to do different goals. While I have almost completely de-googled my life a few years ago, it is just stupid to attribute malice to anything they touch -- they have plenty of good contributions, certain parts of AOSP being an example. I would be happy to have that on a GrapheneOS phone for example, if I hadn't went with Apple.
- sph 3y agoThis is not a Googler's 20% project. You can expect any major feature released to have been infected with Google's morality and mentality of being an ad company needing to extract profit out of free products. You cannot apply Hanlon's Razor to megacorporations.
- pulpfictional 3y agoGrapheneOS has had 4G only mode for a while, not sure about the rest. I wouldn't be surprised if there'd been some communication on their end. I wouldn't say malice but some of their practices are hostile.
- kaba0 3y agoSome of their practices are, my gripe is with the “all” quantifier.
- Denatonium 3y agoI think a lot of Android devices have that; you type ##4636## into the dialer, and a menu appears. In that menu, you can select which cellular technologies are used.
- hnburnsy 3y agoHow about closing the freaking always on VPN leak first... https://issuetracker.google.com/issues/250529027 https://issuetracker.google.com/issues/250529027
- Ms-J 3y ago[dead]
- fodkodrasz 3y agoSo I guess NSA and other state actors have other solutions at hand now, that is why it can be done for some internet points.
- jillesvangurp 3y agoYes, they just ask companies for direct access. With a bit of arm twisting, they mostly get what they need because they have the law on their side and cooperation is not optional. No need for back doors if you can just come in via the front door.
- zerof1l 3y agoGrapheneOS had this since December, 2021. Nonetheless, its good that these features are becoming mainstream.
- abwizz 3y agointeresting i was running various jelly bean custom roms and band selection was a common feature iirc
- can16358p 3y agoSeeing all the comments, I think the best option could have been 2G default off (perhaps with a popup when nothing but 2G is available saying that "fallback to 2G temporarily? It is not encrypted" kind of alert, with the exception of emergency calls always available over 2G regardless of user prefs.
- acd 3y agoThis should also be implemented in Apple iOS.
- exabrial 3y ago[flagged]