Android 17 Adds New Network Security Features to Block 2G SMS Blaster Attacks

Android 17 introduces a new set of network security controls to reduce cellular downgrade attacks, protect local networks, and limit metadata exposure during encrypted web sessions.

This update includes carrier-managed 2G shutdown capabilities designed to combat SMS blaster campaigns that increasingly target users in public spaces.

Google states the Android 17 changes focus on four core areas: Encrypted Client Hello support, enforcement of Local Network Protection, default Certificate Transparency, and enhanced protections against legacy 2G cellular threats.

Carrier-Controlled 2G Protection

The most significant anti-fraud feature is a zero-click mechanism that allows participating mobile carriers to turn off 2G connectivity for subscribers by default. This change targets “SMS blasters,” which are rogue base stations or false cellular towers.

Attackers use high-powered portable radio equipment to impersonate legitimate cell sites. Nearby devices can be manipulated to disconnect from modern LTE or 5G networks and revert to 2G, a legacy protocol with much weaker security measures.

Once devices connect through the rogue infrastructure, attackers can send phishing SMS messages that may bypass carrier-level spam controls and traditional anti-scam filtering.

SMS blaster operations have been reported in crowded locations, including city centers, transit systems, and commercial districts. Criminal groups can deploy vehicle-mounted or suitcase-sized devices to target many phones within range, sending fraudulent messages that impersonate banks, delivery services, government agencies, or mobile providers.

Android 12 introduced a manual option to turn off 2G connectivity at the hardware level. Android 17 evolves this safeguard by allowing carriers to apply the restriction by default, removing the need for users to discover and configure the setting themselves. The effectiveness of this protection relies on carrier participation and compatible device hardware.

Android 17 also introduces platform support for Encrypted Client Hello (ECH), a privacy technology that hides the destination hostname during the initial stage of an HTTPS connection.

While HTTPS encrypts the contents of web traffic, certain metadata, including the domain a device is attempting to reach, may still be visible to network operators, Wi-Fi providers, and other entities monitoring network traffic. This information can be used to profile browsing behavior or enhance the effectiveness of phishing and surveillance operations.

ECH encrypts the Server Name Indication-related information exchanged during the TLS handshake. When used alongside Android’s Private DNS capability, this feature makes it more challenging for network observers to determine which websites and supported apps a user is accessing.

Google describes Android 17 as the first major mobile operating system to offer broad ECH support. Application developers can adopt this protection by upgrading to OkHttp 5.5.0 and enabling ECH in their network configurations.

The release also begins enforcing Local Network Protection, requiring applications to request user permission before scanning for or connecting to devices on a local Wi-Fi network.

Previously, applications connected to a home network could potentially identify nearby devices, such as smart televisions, cameras, speakers, consoles, and connected appliances. This visibility could expose details about a household’s technology environment and create opportunities for profiling or lateral network targeting.

For common functions such as casting media to a television, Android recommends that developers use secure system-provided selection tools instead of requesting broad visibility into every device connected to the network.

Additionally, Android 17 enables Certificate Transparency by default. This measure mandates that publicly trusted certificates be recorded in public, auditable logs.

Certificate Transparency helps detect improperly issued or malicious certificates that could enable attackers to impersonate websites and intercept encrypted traffic. By making certificate issuance publicly observable, this control adds accountability to the web’s public-key infrastructure.

Overall, the changes in Android 17 shift several security protections from optional settings to default, platform-level defenses against cellular fraud, network reconnaissance, traffic interception, and metadata collection.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC