Android 17 and Your Business Phones: Blocking Mobile Malware

Mobile phones are essential tools for almost every small business, from delivery drivers to front desk staff. But with great utility comes great risk. Phishing attacks, malware, and lost devices pose constant threats to your company data and operations. Staying ahead means understanding the latest security changes and implementing practical protections.

Google is continually enhancing Android’s built-in defenses. A significant upcoming change in Android 17, for devices with Advanced Protection enabled, directly addresses a major pathway for mobile malware: the abuse of accessibility services. This update helps secure devices against sophisticated threats, but it also highlights why a proactive approach to Android mobile device management is more important than ever for small businesses.

The Hidden Threat: How Malware Uses Accessibility Services

Many Android users unknowingly grant accessibility service permissions to apps that aren’t actually accessibility tools. These services are designed to help users with disabilities interact with their device, but malicious apps have long exploited them. Once granted, a rogue app can read screen content, overlay fake login screens, capture keystrokes, and even perform actions on behalf of the user – all without direct interaction. This makes them a prime target for phishing and data theft, allowing attackers to steal credentials or financial information directly from your employees’ work phones.

These threats aren’t just theoretical. Data breaches can expose sensitive employee or customer information, leading to financial losses and reputational damage. While large companies have dedicated security teams, small businesses often rely on owners or office managers to handle mobile security, making straightforward, effective solutions critical.

Android 17’s New Shield: Verified Accessibility Tools

Google is addressing this vulnerability head-on. With Android 17, devices that have Advanced Protection enabled will limit access to accessibility services. Only applications specifically classified as “Accessibility Tools” and verified by Google will be able to use these powerful APIs Google has announced. This change aims to block a major attack pathway that malware and financial fraud apps have historically used.

For your business, this means a tighter ecosystem for apps on managed devices. While this protection is for devices with Advanced Protection enabled, the principle applies to all Android phones: be careful about what apps employees install and what permissions they grant. NounDesk helps you control this by letting you manage apps through Managed Google Play. You can set apps as Required, Available, or Blocked, ensuring employees only access trusted applications. You can even publish your own company-built app privately, visible only to your devices. This reduces the risk of employees installing unverified apps that could compromise your devices.

Beyond Malware: Core Device Security for Small Business

Even with advanced protections, fundamental mobile security practices remain essential. These include:

Keeping Devices Updated and Patched

Android security bulletins are released monthly, addressing newly discovered vulnerabilities. Running outdated software is like leaving your front door unlocked. A device with an out-of-date security patch is more vulnerable to known exploits, as a recent report on a critical flaw in Rejetto HFS shows how attackers quickly target known weaknesses according to VulnCheck. NounDesk’s dashboard shows you the security update age for every device in your fleet, helping you identify phones that need attention. You can configure update schedules within your security policies to ensure devices stay patched automatically. For more details on this, see our article How to Keep Company Android Phones Updated and Patched.

Screen Lock and Encryption

A strong screen lock (PIN, pattern, or fingerprint) prevents unauthorized access if a device falls into the wrong hands. Device encryption scrambles all data on the phone, making it unreadable without the correct key, even if someone bypasses the screen lock or removes the storage. NounDesk’s security policy templates, like “Maximum Security” or “Standard Business,” include plain-English settings for requiring a screen lock, setting auto-lock timers, and enforcing device encryption.

Google Play Protect

This built-in Android service scans apps for malware before and after installation. Ensuring it’s active on all company devices adds another layer of defense. NounDesk’s Device Trust feature automatically checks for Google Play Protect status, along with other security indicators like system integrity and unknown app sources, giving you a clear “Trusted,” “At risk,” or “Not trusted” rating for each device.

Protecting Lost Devices and Meeting Compliance

The physical security of your devices is just as important as software security. A lost or stolen company phone can lead to a data breach, as highlighted by incidents like the Frontline Education breach where employee data was stolen after attackers exploited a vulnerability BleepingComputer reports.

Lost Mode and Remote Erase

If an employee loses a company phone, you need to act fast. NounDesk’s Lost mode locks the screen with your custom message and contact number, and reports the device’s location with a Google Maps link. If recovery isn’t possible, a remote Erase command wipes all company data, keeping factory reset protection active so the device can’t be reused by an unauthorized person. Our article Employee Lost a Work Phone? What to Do in the First Hour offers a step-by-step guide.

Data Protection Policies

Compliance reviewers and insurers often ask about your mobile device security measures. They want to know how you protect sensitive data. NounDesk policies allow you to block actions like printing, using SD cards, USB drives, screenshots, and USB file transfer, especially useful for the “Maximum Security” template. This helps prevent company data from leaving the device without authorization.

A Plain-English Mobile Device Policy

A written policy is your first line of defense. It clarifies expectations for employees regarding device usage, security, and what to do if a device is lost. A plain-English policy reduces real risk by ensuring everyone understands their responsibilities. NounDesk’s policy settings are designed to be clear and understandable, making it easier to translate your digital settings into a written company policy.

What to Do This Week

1. Review your current security policies: Check your screen lock requirements, auto-lock timers, and ensure device encryption is enforced.
2. Check your fleet’s update status: Use your MDM dashboard to see the security update age of your devices. Prioritize updating any phones that are more than 90 days out of date.
3. Audit your app management: If you’re not already, consider using Managed Google Play to control which apps employees can install. Block unknown app sources in your security policy.
4. Confirm your lost device protocol: Ensure you have a clear plan for what to do if a company phone is lost or stolen, including how to activate lost mode and perform a remote erase.
5. Draft or update your mobile device policy: Outline acceptable use, security requirements, and procedures for lost devices.

FAQ

What is Android Advanced Protection?

Android Advanced Protection is a set of enhanced security features offered by Google for users at higher risk of targeted attacks. It includes stricter checks for app installations, stronger account authentication, and now, with Android 17, tighter controls over accessibility services for verified tools.

How do I know if an app is a “verified accessibility tool”?

Google’s Play Store will classify apps as “Accessibility Tools” based on their manifest declarations and verification process. For devices with Advanced Protection enabled, only apps meeting this classification will be able to utilize accessibility services. For your managed fleet, focusing on apps from Managed Google Play helps ensure app legitimacy.

What happens if an employee loses a company phone with sensitive data?

If a company phone is lost, you should immediately activate Lost mode through your Android MDM. This locks the device, displays a contact message, and reports its location. If recovery isn’t possible, use the remote Erase command to wipe all company data, protecting sensitive information and keeping factory reset protection active.

Protecting your company’s Android devices doesn’t have to be complicated. By understanding the evolving threat landscape and implementing straightforward security measures, you can significantly reduce your business’s risk. See how NounDesk manages Android fleets. Visit

Ready to put this into practice? See how NounDesk manages Android fleets.