APK teardown hints at Intrusion Detection feature in Android 16

With smartphone users everywhere looking forward to the highly anticipated Android 16 release, Google seems to be preparing a surprise anti-spying feature, collecting an end-to-end encrypted log of the device’s and network’s activities for review.

Indeed, as the code for the Play Services app suggests, the next Android release will include an Intrusion Detection system allowing users to keep track of any suspicious activity across their account or devices, according to a report by Android Authority published on May 5.

Furthermore, the Android 16 work-in-progress code indicates that users will be able to access this encrypted log using their Google account password and device authentication. Specifically, the code part in question involves lots of strings related to this upcoming feature:

<string name=”intrusiondetection_learn_more”>Device protection helps keep your device and data safe, but there are some things to know about turning on the protections.</string>
<string name=”intrusiondetection_main_user_warning”>Only the primary user can change this setting</string>
<string name=”intrusiondetection_readonly_pref_1_desc”>Your activity logs will be stored in a private and encrypted Google Drive. This logs can be used for forensic analysis in cases of suspicious activity.</string>
<string name=”intrusiondetection_readonly_pref_1_title”>Intrusion detection</string>
<string name=”intrusiondetection_readonly_pref_2_desc”>You are agreeing to E2EE log collection, such events as USB events, network info such as browsing history, app installs, Bluetooth connections, lockscreen info, and wifi. Only you are able to decrypt this data with your account password and device lock screen.</string>
<string name=”intrusiondetection_readonly_pref_2_title”>Log collection</string>
<string name=”intrusiondetection_resources_card_desc”>This Google Account will be used to encrypt your logs. Be sure you are selecting the right account.</string>
<string name=”intrusiondetection_resources_card_title”>Google Account</string>
<string name=”intrusiondetection_switch_title”>Activate Intrusion Detection</string>
<string name=”intrusiondetection_title”>Setup Advanced Protection</string>

How the Intrusion Detection system works

As it appears, the Intrusion Detection system keeps private, encrypted logs of system and network activities like app installs, USB events, Bluetooth connections, lock screen information, Wi-Fi, and browsing history, to analyze in case of odd activity, preventing it from stealing.

Meanwhile, the newest feature is part of Google’s growing dedication to security, especially as its crucial security program, the 25-year-old centralized Common Vulnerabilities and Exposure (CVE) database of product security flaws has come to an end by the decision of the United States government.

Elsewhere, Google is bringing other innovations to its Play Store, including a swipe-to-confirm feature when buying apps or signing up for paid subscriptions in a bid to minimize the number of accidental purchases that often occurred with the previous buy button. It has also removed millions of apps over the last year as part of tightening its policies around app quality.