Google has introduced a new security feature in Android 14 that lets IT administrators deactivate support for 2G cellular networks on devices they manage.
This feature adds a second user option to turn off support for null-ciphered cellular connections at the device model level, enhancing security.
What are null-ciphered cellular connections?
A null cipher cellular connection refers to a communication link lacking encryption or security measures to protect the data transmitted between a mobile device and a cellular network. In such a connection, the data is essentially sent in plain, unencrypted form, making it vulnerable to malicious parties’ interception, eavesdropping, and unauthorized access.
What does Google believe?
According to Google, the Android Security Model is cautious towards all networks to protect users from threats like packet injection, tampering, or eavesdropping.
Rather than relying on link-layer encryption, Android ensures that all network traffic is end-to-end encrypted (E2EE) for safety.
2G networks have weak encryption and lack mutual authentication, making them susceptible to attacks where communication traffic can be intercepted and decrypted. Malicious actors could exploit this threat for various purposes, including
- intercepting traffic,
- distributing malware,
- launching denial-of-service (DoS) attacks, and
- performing adversary-in-the-middle (AitM) attacks, raising surveillance concerns.
Have the 2G connections been exploited before?
An example of such an attack was revealed by Amnesty International in June 2020, involving a Moroccan journalist targeted with network injection attacks, likely using a fake cell tower to deploy the Pegasus spyware.
Worse yet, attackers could use advanced cell-site simulators (Stingrays) to force mobile devices to connect to 2G networks, thanks to the prevalent support for 2G bands in existing devices.
To tackle these concerns, Google first added an option to turn off 2G at the modem level in Android 12. They’re going further by preventing devices from downgrading to 2G connectivity.
What do you expect in the latest release?
The upcoming Android release also addresses the vulnerability of null ciphers (non-encrypted mode or GEA0) in commercial networks, which exposes voice, SMS traffic, and one-time passwords (OTPs) to interception attacks.
In related news, Google enables end-to-end encryption (E2EE) for RCS conversations in its Messages app for Android. While some users may need to agree to carrier network Terms of Service, this move strengthens privacy.
Additionally, Google plans to support Message Layer Security (MLS) for better interoperability with other messaging services.
“RCS is the modern industry standard for dynamic and secure messaging. And now, all of your RCS conversations in Messages by Google are end-to-end encrypted, including group chats, which keeps them private between you and the people you’re messaging.”
“To ensure more people benefit from this added security, RCS will now be enabled by default for new and existing users*, unless they’ve previously turned RCS off in Settings. You can always turn RCS on or off in Settings at any time.”
Google continues to be secure. What about You?
Google has urged Apple to adopt RCS, but the iPhone maker remains committed to iMessage for encrypted messaging.
There’s no sign of iMessage on Android, leaving people texting between the two systems to opt for third-party messaging apps.
Google is also committed to solving security issues in academic institutions.
Let us know about the small steps you take daily to have a better digital presence.
PureVPN
August 10, 2023
2 years ago
