Ron Amadeo reports via Ars Technica: To help combat the surge of sideloaded malware, Google Play can now pop up a malware scanner at install time if it decides the app you're trying to sideload is interesting. Google Play's malware system, called "Google Play Protect," has always been able to check sideloaded apps for malware, but it used faster techniques like a definition file, and this happened quietly in the background. This new technique will delay your app installation with a full-screen "scanning" interface while Google runs a deep scan of the app code. Google's blog post says this is "real-time scanning at the code-level to combat novel malicious apps" and that Google Play Protect can "recommend a real-time app scan when installing apps that have never been scanned before to help detect emerging threats." The scan will involve sending bits and pieces of the app to Google for analysis. Google says: "Scanning will extract important signals from the app and send them to the Play Protect backend infrastructure for a code-level evaluation. Once the real-time analysis is complete, users will get a result letting them know if the app looks safe to install or if the scan determined the app is potentially harmful. This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection." [...] Google is first rolling this feature out in India -- a country that topped the malware distribution charts in that 2018 report -- with the company saying the feature "will expand to all regions in the coming months."

Read more of this story at Slashdot.

The Android ecosystem is hurtling toward a RISC-V future. From a report: The puzzle pieces for the up-and-coming CPU architecture started falling into place this past year when Google announced official RISC-V support in Android and plans to make it a "tier 1 platform" on equal footing with Arm. With the OS support underway, what we need now is hardware, and Qualcomm is stepping up to announce the first-ever mass-market RISC-V Android SoC. It doesn't have a name yet, but Qualcomm says it's developing a "RISC-V Snapdragon Wear" chip in collaboration with Google. The company says it plans to "commercialize the RISC-V based wearables solution globally including the US." For Google and Qualcomm, this chip represents everyone's first swing at a commercial RISC-V Android project, and as far as we can tell, it's the first announced mass-market RISC-V Android chip ever. Qualcomm says the groundwork it and Google lay out "will help pave the way for more products within the Android ecosystem to take advantage of custom CPUs that are low power and high performance." RISC-V represents a big threat to the Arm CPU architecture that currently dominates all mobile devices. RISC-V architecture is open source, which can make it cheaper and more flexible than Arm. If companies want to design their own chips, they can do that without paying a licensing fee to Arm. Since the architecture is open source, it's possible to create a fully open source chip. If you're a chip-design firm, you can make your own proprietary chip designs and license them, making you a competitor to Arm's chip-design business. RISC-V is also a way to sidestep all of the various problems with Arm.

Read more of this story at Slashdot.

Keumars Afifi-sabet reports via TechRadar: Lenovo has the green light to see a portfolio of new enterprise-focused devices powered by Esper Foundation -- a custom Android operating system -- and bundled with a complementary mobile device management (MDM) platform. The firm's first device running Esper Foundation is the Lenovo ThinkCentre M70a, an all-in-one desktop PC fitted with an up to 12th-Gen Intel Core i9 CPU, alongside 16GB DDR4 RAM and up to 512GB SSD. It'll be followed by the Lenovo ThinkCentre M70q, M90n-1 IoT, and the ThinkEdge SE30 v2 machines by the end of 2023. Esper Foundation is based on Android 11 and has customizable branding, peripheral compatibility, quarterly security patches, and three years of support. The MDM system, meanwhile, remotely deploys, manages, and updates devices from a single view. By integrating a custom version of Android in its PCs, Lenovo is banking on the Esper Foundation OS appealing to businesses as an alternative to Windows, as well as Google's own ChromeOS. With platforms like Esper's, there may well be a means to find a rival to compete with Windows in the enterprise, particularly in highly niche industries such as the retail, hospitality, and healthcare industries -- at which Esper Foundation is directed. "This collaboration is another step forward in Lenovo's drive to meet changing customer demand across retail, hospitality, healthcare, and other industries," said Johanny Payero, Lenovo's director of global advanced solutions marketing and strategy. "Dedicated devices are proliferating across several key industries, and our new joint solution with Esper allows us to deliver the best of Android with the consistency and predictability of Lenovo's x86 devices."

Read more of this story at Slashdot.

Since 2012, Google Pixel phones have had a Photo Sphere Mode, allowing users to capture 360-degree images. Now, according to Android Authority, Google has dropped the feature from the Pixel 8 series with no explanation given. From the report: Photo Sphere Mode allowed you to capture panoramic 360-degree pictures by stitching multiple images together. The feature was first introduced back in 2012 on the Nexus 4 and persisted well into the Pixel era, with the likes of the Pixel Fold and Pixel 7a still offering it. The act of capturing a Photo Sphere wasn't exactly seamless owing to the sheer number of images required, although it had an admittedly intuitive UI. Significant stitching issues and exposure/white balance differences were also very common. We're therefore not surprised Google has decided to drop the feature. Even without taking the aforementioned issues into account, the mode's utility seemed limited beyond some scenarios like mapping purposes (e.g. viewing environments in Google Maps) and VR. In saying so, we hope the company rebounds with a more polished take on 360-degree photos in the future.

Read more of this story at Slashdot.

An anonymous reader quotes a report from SecurityWeek: Tens of thousands of Android devices have been shipped to end-users with backdoored firmware, according to a warning from cybersecurity vendor Human Security. As part of the global cybercriminal operation called BadBox (PDF), Human Security found a threat actor relied on supply chain compromise to infect the firmware of more than 70,000 Android smartphones, CTV boxes, and tablet devices with the Triada malware. The infected devices come from at least one Chinese manufacturer but, before they are delivered to resellers, physical retail stores, and e-commerce warehouses, a backdoor was injected into their firmware. "Products known to contain the backdoor have been found on public school networks throughout the United States," Human says. Discovered in 2016, Triada is a modular trojan residing in a device's RAM, relying on the Zygote process to hook all applications on Android, actively using root privileges to substitute system files. Over time, the malware went through various iterations and was found pre-installed on low-cost Android devices on at least two occasions. As part of the BadBox operation that Human Security discovered, the infected low-cost Android devices allow threat actors to carry out various ad-fraud schemes, including one named PeachPit, which at its peak relied on 121,000 Android and 159,000 iOS devices infected with malware, and on 39 Android, iOS, and CTV-centric apps designed to connect to a fake supply-side platform (SSP). One of the modules delivered to the infected devices from the command-and-control (C&C) server allows the creation of WebViews that are fully hidden from the user, but which "are used to request, render, and click on ads, spoofing the ad requests to look like they're coming from certain apps, referred by certain websites, and rendered" on specific devices. BadBox, Human Security notes, also includes a residential proxy module that allows the threat actors to sell access to the victim's network. Furthermore, they can create WhatsApp messaging accounts and Gmail accounts they can then use for other malicious activities. "Finally, because of the backdoor's connection to C2 servers on BadBox-infected smartphones, tablets, and CTV boxes, new apps or code can be remotely installed by the threat actors without the device owner's permission. The threat actors behind BadBox could develop entirely new schemes and deploy them on BadBox-infected devices without any interaction from the devices' owners," Human notes.

Read more of this story at Slashdot.

Simon Sharwood writes via The Register: The Chinese manufacturer that took over IBM's PC business announced on Thursday that it's teamed with an outfit named Esper that specializes in custom cuts of Android, plus device management offerings. Android is most commonly used in handheld devices. Lenovo's taking it in an entirely different direction by making the ThinkCentre M70a: a desktop all-in-one. The first fruit of the collaboration with Esper, the ThinkCentre M70a boasts a 21 -- inch touch screen and offers a choice of 12th-gen Intel core CPUs from the Core i3 to the almost workstation-grade Core i9, at prices from $889 to beyond $1250. What could you do with Android on a Corei9, plus the maximum 16GB DDR4 3200MHz and 512GB PCIe SSD Lenovo's machines allow? Almost anything -- but Lenovo thinks its Android effort will first be appreciated by customers in the retail, hospitality, and healthcare industries. Esper pitches its wares as ideal for point-of-sale systems, kiosks, and digital signage -- environments where users don't need to access diverse apps but do need a machine that reliably boots into custom environments. Lenovo's not just doing desktop PCs. The number one PC maker by market share has promised it will also ship Esper's wares on the small form factor ThinkCentre M70q -- a machine designed to be bolted to the back of monitors. The ThinkEdge SE30 -- a ruggedized and fanless edge client -- will also have an Android option. So will the ThinkCentre M90n-1 IoT [PDF] -- another rugged client for edge applications.

Read more of this story at Slashdot.

Android 14 is out today, along with a new Pixel phone. The OS is shipping to supported Pixel devices now, which means the Pixel 4a (5G) and every variant of the Pixel 5, 6, and 7, plus the Fold and Tablet. From a report: The big feature this year is a somewhat customizable home screen. You can pick from several different lock screen clock styles and customize the two bottom app shortcuts. This feels like a response to iOS 16's lock screen widgets (a feature Android used to have back in the 4.2 days) but not nearly as customizable. It's honestly hard to highlight a second Android 14 feature because this is one of the smallest Android releases ever. The first feature Google mentions in its blog post is a new wallpaper picker. On the Pixel 8, Android now has a built-in text-to-image AI wallpaper maker, presumably a feature that lets the Android team adhere to Google's "mandatory AI" company mandate. There's also a new monochrome theme if you're tired of all those "Material You" colors.

Read more of this story at Slashdot.

Esper: Starting in Android 14, it may not be necessary to use a third-party app to turn your smartphone into a webcam for your PC, as that functionality is getting baked into the Android OS itself -- though there's a catch. When you plug an Android phone into a PC, you have the option to change the USB mode between file transfer/Android Auto (MTP), USB tethering (NCM), MIDI, or PTP. In Android 14, however, a new option can appear in USB Preferences: USB webcam. Selecting this option switches the USB mode to UVC (USB Video Class), provided the device supports it, turning your Android device into a standard USB webcam that other devices will recognize, including Windows, macOS, and Linux PCs, and possibly even other Android devices. Webcam support in Android 14 is not enabled out of the box, however. In order to enable it, four things are required: a Linux kernel config needs to be enabled, the UVC device needs to be configured, the USB HAL needs to be updated, and a new system app needs to be preloaded.

Read more of this story at Slashdot.

According to Android specialist Mishaal Rahman, Android miscalculates the storage space taken up by system components, leading to inflated system storage utilization and potentially misleading users. Chandraveer Mathur writes via Android Police. From the report: We usually rely on Android's storage utilization utility to find apps and files eating up storage space, so we can uninstall or delete them if required. However, Android specialist Mishaal Rahman discovered that Google's calculation of the space consumed by Android system components is flawed. He executed shell commands to create a 3GB file in the /data/media/0 storage directory, which isn't a file path used for Android system files. However, the phone's storage breakdown showed a marked 3GB increase under the System heading, suggesting the OS suddenly became bigger. This happens because Android calculates system storage as the space used up by anything other than what's covered by other categories in the storage breakdown, including audios, videos, images, documents, trash, and games. This means the System heading in the break doesn't just include Android system files. Android 14 also uses this dangerously flawed logic for calculating storage usage. Moreover, the Files app by Google also shows similar storage utilization by Android system components, perhaps because it uses the same incredulous attribution logic. By association, all other Android skins use flawed calculation of used storage space, but Samsung reportedly fixed this issue with the One UI 6 update. After running similar ADB commands as in the previous experiment, Rahman could confirm the increased utilization showed up under the Other files heading in the storage breakdown, instead of the System heading.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Russia's military intelligence unit has been targeting Ukrainian Android devices with "Infamous Chisel," the tracking name for new malware that's designed to backdoor devices and steal critical information, Western intelligence agencies said on Thursday. "Infamous Chisel is a collection of components which enable persistent access to an infected Android device over the Tor network, and which periodically collates and exfiltrates victim information from compromised devices," intelligence officials from the UK, US, Canada, Australia, and New Zealand wrote (PDF). "The information exfiltrated is a combination of system device information, commercial application information and applications specific to the Ukrainian military." Infamous Chisel gains persistence by replacing the legitimate system component known as netd with a malicious version. Besides allowing Infamous Chisel to run each time a device is restarted, the malicious netd is also the main engine for the malware. It uses shell scripts and commands to collate and collect device information and also searches directories for files that have a predefined set of extensions. Depending on where on the infected device a collected file is located, netd sends it to Russian servers either immediately or once a day. When exfiltrating files of interest, Infamous Chisel uses the TLS protocol and a hard-coded IP and port. Use of the local IP address is likely a mechanism to relay the network traffic over a VPN or other secure channel configured on the infected device. This would allow the exfiltration traffic to blend in with expected encrypted network traffic. In the event a connection to the local IP and port fails, the malware falls back to a hard-coded domain that's resolved using a request to dns.google. Infamous Chisel also installs a version of the Dropbear SSH client that can be used to remotely access a device. The version installed has authentication mechanisms that have been modified from the original version to change the way users log in to an SSH session. [...] The report didn't say how the malware gets installed. In the advisory Ukraine's security service issued earlier this month (PDF), officials said that Russian personnel had "captured Ukrainian tablets on the battlefield, pursuing the aim to spread malware and abuse available access to penetrate the system." It's unclear if this was the vector.

Read more of this story at Slashdot.

According to a report from Technews Taiwan, ASUS has shut down its Zenfone division responsible for making some of the best compact Android flagships on the market. The reason is due to "internal restructuring." Employees in the Zenfone division are being moved over to the ROG Phone team and other parts of the business. Android Authority reports: The report further asserts that the Zenfone 10 will be the last phone in the Zenfone series. Since the team no longer exists, there is unlikely to be a successor to this phone. The report follows other incidents around Zenfone. Earlier in the month, ASUS stopped allowing bootloader unlocks for Zenfone owners. The company maintained that they are not stopping the possibility of unlocking, just that the tool is currently unavailable. A few weeks ago, community members also spotted that ASUS had removed older Zenfone firmwares from its website. Community moderators responded that ASUS no longer provides previous firmware versions or downgrade packages to ensure users remain on up-to-date firmware. Both of these incidents do not directly point to the shutdown of the Zenfone division. But they add the value of hindsight to the report, and we can't help but wonder if the writing was on the wall all this time.

Read more of this story at Slashdot.

The latest update to the Android Runtime (ART) -- the "engine behind the Android operating system (OS)" -- has resulted in app startup time "improvements of up to 30% on some devices," says Google. 9to5Google reports: Behind the scenes, "ART is the same for all devices" and: "The ART APEX module is a complex piece of software with an order of magnitude more APIs than any other APEX module. It also backs a quarter of the developer APIs available in the Android SDK. In addition, ART has a compiler that aims to make the most of the underlying hardware by generating chipset-specific instructions, such as Arm SVE." The testing process for Android Runtime updates involves "compiling over 18 million APKs and running app compatibility tests, and startup, performance, and memory benchmarks on a variety of Android devices that replicate the diversity of our ecosystem as closely as possible." There's then a very gradual rollout process. Google also notes developer improvements with every update "like OpenJDK improvements and compiler optimizations that benefit both Java and Kotlin," with ART 13 resulting in the "fastest-ever adoption of a new OpenJDK [11] release on Android devices." ART 14 is rolling out "in the coming months" with "new compiler and runtime optimizations that improve performance while reducing code size," as well as OpenJDK 17.

Read more of this story at Slashdot.

Scott DeVaney, writing at Mozilla blog: In the coming months Mozilla will launch support for an open ecosystem of extensions on Firefox for Android on addons.mozilla.org (AMO). We'll announce a definite launch date in early September, but it's safe to expect a roll-out before the year's end. Here's everything developers need to know to get their Firefox desktop extensions ready for Android usage and discoverability on AMO. For the past few years Firefox for Android officially supported a small subset of extensions while we focused our efforts on strengthening core Firefox for Android functionality and understanding the unique needs of mobile browser users. Today, Mozilla has built the infrastructure necessary to support an open extension ecosystem on Firefox for Android. We anticipate considerable user demand for more extensions on Firefox for Android, so why not start optimizing your desktop extension for mobile-use right away?

Read more of this story at Slashdot.

OpenAI has released ChatGPT for Android, months after launching the free iOS app for iPhones and iPads. You can download it in the Google Play Store. The Verge reports: According to a company tweet, it's available first in the US, India, Bangladesh, and Brazil, with other countries set to follow later, mimicking the staged rollout we saw for the iOS version. On July 27th, OpenAI announced additional availability, saying the Android ChatGPT app is now available in Argentina, Canada, France, Germany, Indonesia, Ireland, Japan, Mexico, Nigeria, the Philippines, the UK, and South Korea.

Read more of this story at Slashdot.

Google is changing the Play Store ranking algorithms to increase the visibility of apps that better support large screens. Google detailed the changes in a blog post: "Apps and games that adhere to our large screen app quality guidelines will now be ranked higher in search and Apps and Games Home. This helps users find apps that resize well, aren't letterboxed, and support both portrait and landscape orientations. Editors' Choice and other curated collections and articles will also consider these criteria going forward, creating new featuring opportunities for optimized apps." Ars Technica reports: The large-screen app guidelines have various tiers, but they recommend keyboard, mouse, and stylus support, a two-pane tablet layout, drag-and-drop support, and foldable display awareness. The post also reiterates some improvements that Google has already rolled out, like showing tablet screenshots to tablet users and downranking apps that crash a lot. The big news is that the search results will switch to a two-pane layout on big screens. The search result list will live on the left-hand side, and tapping on each result will load a details page on the right. Previously, the results page was a stretched-out phone interface, with results on the left and nothing on the right. It would be nice if the top charts got this two-pane design, too, but that hasn't changed yet. Google says these changes are "just the beginning of our journey in creating a tailored Play Store experience for large screens." So hopefully, Google's developers will follow Google's developer guidelines soon.

Read more of this story at Slashdot.

Which is better: iPhone or Android? Instagram head Adam Mosseri weighed in on the topic earlier this week, reigniting a debate that has waged on since the dawn of smartphones. From a report: "Android's now better than iOS," Mosseri posted in response to tech YouTuber Marques Brownlee, aka MKBHD, who had asked for people's best tech "hot takes." Mosseri didn't get into why he felt Android to be superior, but his use of the words "now better" implies that he may have previously felt Apple's iOS had the edge.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: No one in the Android ecosystem can hold a candle to Apple's software support timeline for the iPhone, but there is one company that comes the closest: Fairphone. Following in the footsteps of the Fairphone 2, the Fairphone 3 is also getting an Android-industry-best seven years of OS support. Fairphone continues to run circles around giant tech companies that have a lot more resources than it does, and it's doing this even in the face of component vendors like Qualcomm dropping support for the phone's core components. The company announced today that the Fairphone 3, which was released in 2019, has had its support extended to 2026, making for seven years of updates. The company also just released Android 13 for the Fairphone 3. Google's own 2019 phone, the Pixel 4, shut down support in October 2022. Fairphone strives to make sustainable smartphones, designing its products to be repairable and also offering replacement parts for sale online. Part of that sustainability mission is an absolutely herculean effort to keep the Android updates flowing, even when Qualcomm drops critical software support for the SoC. Fairphone says the Snapdragon 632 SoC in the Fairphone 3 was only supported up to Android 11, so continuing to support the Fairphone 3 meant doing the upgrades all by itself.

Read more of this story at Slashdot.

The new Nubia RedMagic 8S Pro+ features support for up to 24GB of RAM -- the same amount of RAM found in a 13-inch top-spec M2 MacBook Pro. Ars Technica reports: The base model of the RedMagic 8S Pro+ starts with 16GB of RAM, but GSMArena has pictures and details of the upgraded 24GB SKU, which is the most amount of memory ever in an Android phone. Because we're all about big numbers, it also comes with 1TB of storage. This suped-up 24GB version of the phone appears to be a China-exclusive, with the price at CNY 7,499 (about $1,034), which is a lot for a phone in China. Other specs include a new "Snapdragon 8+ Gen 2" variant, which appears to be the same higher-clocked version that Samsung gets for the S23. This runs at 3.36 GHz as opposed to the normal 3.2 GHz. There's a 6.8-inch, 120 Hz 2480x1116 OLED display and a 5000 mAh battery with a blazing-fast 165 W charging that can fully charge in 14 minutes. The display has an under-screen front camera, because selfies would just get in the way of gaming. The design is interesting -- it's just all right angles without a single smoothed-over edge on the entire phone. The sides are flat, the back is flat, and the corners are super tall, with almost no corner radius at all. In landscape mode, there are touch-sensitive shoulder buttons along the top edge for additional gaming controls, but it does not look comfortable to have to wrap your fingers around those hard corners. Just picture the smooth curves of an SNES controller compared to this thing -- even the example image does not look very comfortable. For color options, it comes in black, silver, or a clear back panel with a faux-mechanical design under it, just like a Nothing Phone. That little rainbow circle on the back is a spinning, 20,000 RPM blower fan that pushes heat out the side, so you'll presumably be gaming with cool temps for a long time. The phone is up for pre-order today in China and ships on July 11.

Read more of this story at Slashdot.

The Fairphone 4 -- a user-repairable smartphone built using ethically sourced materials -- is finally coming to the US, almost two years after it first debuted back in September 2021. The Verge reports: Fairphone is partnering with Murena, a company best known for de-Googling Android phones, to launch the US pilot of the Murena Fairphone 4 -- a variant of the handset that runs on a privacy-oriented Android-based operating system: /e/OS. There are two configurations available: one with 6GB of RAM and 128GB of storage for $599 and another with 8GB of RAM and 256GB of storage for $679. The storage of both models can be expanded via microSD, and the phone features a modular design that can be easily disassembled using a standard Phillips #00 screwdriver to replace broken components. It also has an IP54 rating, meaning the device is protected against dust and water sprays. The Murena Fairphone 4 will ship to US customers with 5G and dual SIM support, a removable 3905mAh battery, a 48-megapixel main camera, a 48-megapixel ultrawide, and a 25-megapixel selfie camera. The phones will be available to order exclusively from Murena's webstore starting today. The Murena Fairphone 4 also comes with the /e/ operating system preinstalled, which is described as a privacy-focused, Google-free mobile ecosystem for folks who want to avoid handing any data over to the search giant. Instead of the usual Google apps, the Fairphone 4 will come with a range of default Murena Cloud apps for things like email, calendar, and cloud storage as well as a dedicated app store that highlights the privacy ratings of each app to help users monitor how their online activity is being tracked. The Fairphone comes unlocked, but the press release mentions that T-Mobile and other operators based on T-Mobile's network are the only US carriers recommended to be used with the device. Fairphone is also providing an extended five-year warranty for the hardware, and /e/OS is similarly committed to fixing bugs and supporting security and feature updates for five years. The Murena version is the only Fairphone 4 model being introduced to the US, and there's no mention of the standard Android OS model joining it anytime soon.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Police forces in the UK are seeing a "record number" of false calls to 999, the UK's emergency services number, and the culprit is apparently Android. As the BBC reports, Android 12 added an easy-access feature for emergency services: just press the power button five times, and your phone will dial emergency services for you. That's apparently pretty easy to do accidentally when a phone is sitting in your pocket, or if you have a wonky power button, resulting in a surge of totally silent accidental calls to emergency dispatch. The National Police Chiefs Council tweeted earlier this month that "Nationally, all emergency services are currently experiencing record high 999 call volumes. There's a few reasons for this, but one we think is having a significant impact is an update to Android smartphones." The BBC report says one department "received 169 silent 999 calls between 00:00 and 19:00 BST on Sunday alone." In response to these most recent complaints, Google says it's working on a fix with Android OEMs. The funny thing is, Android 12 -- and this easy emergency call feature -- came out a year and a half ago. Thanks to the unique (uniquely bad) way that Android is rolled out, the feature is only now hitting enough people to become a national problem. Google's Pixel devices get new Android updates immediately, but everyone else can take months or years to get new versions of Android because it's up to your device manufacturer to make new, bespoke Android builds for every device they have ever released. When this landed on Pixel devices in 2021, it was immediately flagged as a problem by some people, with one Reddit post calling it "dangerous." Since then, there has been a steady stream of posts warning people about it. Until a patch comes out, Google's current recommendation is to turn the feature off. While Google developed the feature, it's up to the manufacturers to decide how and when the emergency SOS feature works. Google said in a statement: "To help these manufacturers prevent unintentional emergency calls on their devices, Android is providing them with additional guidance and resources. We anticipate device manufacturers will roll out updates to their users that address this issue shortly. Users that continue to experience this issue should switch Emergency SOS off for the next couple of days."

Read more of this story at Slashdot.