Google adds new security features for Pixel

Google has revealed several security features built into its latest Pixel devices to address the growing threat posed by baseband security attacks.

See also: Samsung One UI 7 based on Android 15, will be released in 2025

The cellular baseband (i.e., the modem) refers to a processor in the device that is responsible for managing all connectivity, such as LTE, 4G, and 5G, with the cell tower or base station via radio communication.

Additionally, the firmware powering the cellular baseband could also be vulnerable to bugs that, if successfully exploited, could undermine the security of the device, particularly in scenarios leading to remote code execution.

In a Black Hat USA presentation last August, a team of Google security engineers described the modem as a “fundamental” and “critical” component of smartphones, which has access to sensitive data and is remotely accessible with various radio technologies.

The baseband threats are not theoretical. In October 2023, research published by Amnesty International found that Intellexa, behind Predator, had developed a tool called Triton to exploit vulnerabilities in the Exynos baseband software used in Samsung to deliver spyware as part of highly targeted attacks.

The attack involves performing a covert degradation process that forces the targeted device to connect to the legacy 2G network via a cell site simulator, after which a 2G base station transceiver (BTS) is used to distribute the malicious payload.

See also: The Google Home app gets a search bar

Since then, Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G mobile networks on their managed devices. It has also highlighted the role that Clang sanitizers (IntSan and BoundSan) play in strengthening cellular baseband security on Android.

Then, earlier this year, the tech giant revealed that it was working with ecosystem partners to add new ways to notify Android users if their mobile network connection is not encrypted and if a rogue cell tower or surveillance tool is recording their location using a device identifier.

The company has also outlined the steps it is taking to combat threat actors' use of cell site simulators, such as Stingrays, to insert SMS messages directly into Android phones, otherwise known as the SMS Blaster.

Some of the other security features Google has added to its new Pixel 9 include stack canaries, control flow integrity (CFI), and automatic initialization of stack variables to zero, to prevent sensitive data from leaking or serving as a means of gaining code execution.

See also: Pixel Camera update improves Wear OS devices

In today’s digital environment, security features are more important than ever to protect sensitive information and ensure privacy. These features range from simple password protection to more advanced systems such as multi-factor authentication, encryption , and biometric verification. Multi-factor authentication (MFA) requires users to provide two or more factors of verification to gain access to a resource, making it more difficult for unauthorized individuals to bypass the safeguards. Encryption is the process of converting data into code to prevent unauthorized access. Biometric verification uses unique physical characteristics, such as fingerprints or facial recognition, to verify identity. Together, these security features work to provide a comprehensive defense against unauthorized access and cyber threats ,effectively protecting personal and organizational data.

Source: thehackernews