Hackers could track your phone through Wi-Fi: Android 17 is changing that
Android 17 overhauls user protection on the network (Photo: Unsplash)
Google has strengthened network security in Android 17 with full support for the Encrypted Client Hello (ECH) standard. The update also guards against hidden Wi‑Fi scanning, forged web certificates, and fraud via fake 2G base stations, according to the Google Security Blog.
The key technological shift is the adoption of the Encrypted Client Hello (ECH) protocol.
Previously, the website name was transmitted in plain text during connection setup - allowing the creation of detailed user interest profiles for advertising or phishing attacks.
Now, ECH encrypts the target domain name in the very first data packet. The internet service provider sees only the fact of a connection to a content delivery network (such as Cloudflare) and the volume of traffic, but not the specific site or application.
For developers, this means migrating to the OkHttp 5.5.0 libraries and optimising DNS queries, though a VPN will still be required for complete IP‑address concealment.
Private home Wi‑Fi and certificate control
The changes also affect local networks. Previously, mobile apps could scan home Wi‑Fi without additional permissions, gathering information about all connected devices - from smart TVs to security cameras. Android 17's security system changes this approach with several tools:
- Local Network Protection: Apps can no longer autonomously probe devices on the local network; any scanning now requires explicit user consent.
- Secure casting: For displaying content on a TV, a system tool has been introduced that transmits the signal to the selected screen without granting the app access to the rest of the home network.
- Certificate Transparency (CT) registry: Verification of website authenticity is now enabled by default. All security certificates must be logged in a public registry, making it impossible to forge encryption keys during certificate authority compromises.
Countering 2G interceptors and SMS attacks
Developers have paid particular attention to protection against so‑called "SMS blasters"—portable fake base stations.
Attackers use these relatively inexpensive devices in crowded places to jam LTE/5G signals and force victims' smartphones onto the outdated, unsecured 2G standard.
Once on a 2G network, a device becomes vulnerable to spam and phishing messages that bypass operator filters.
While Android 12 introduced manual 2G disablement at the hardware level, Android 17 brings a zero‑click solution: mobile operators now have a tool to automatically disable 2G by default for their subscribers, completely eliminating this attack vector out of the box.
