The newest version of the OS contains many new features and
behavior changes, as well as many security improvements and security-related changes.
Android Oreo security improvements
With Android 8.0 Oreo, the platform no longer supports SSLv3 (it was
about time), does not fall back to earlier TLS protocol versions and retry establishing a HTTPS connection if a server that incorrectly implements TLS protocol-version negotiation, and apps’ Web content is now handled in a separate, isolated process from the containing apps’ process.
It was
already known that the newest addition to the Android OS line will prevent apps to draw on top of system UI, in an attempt to foil screen-hijacking malware.
A new restrictive permission called
TYPE_APPLICATION_OVERLAY will block pop-up windows from being positioned above any critical system windows, such as the status bar and IMEs, allowing users to access settings and block the app from displaying alert windows.
Oreo also features
Google Play Protect, a security suite for Android devices that scans and verifies apps users want to download from Google Play, monitors apps users have downloaded from a third-party app store (looking for any change in behavior), periodically scans the device for potentially malicious apps, and
more. The suite constantly updates itself, and is on by default.
Finally, the
Allow unknown source setting is no longer offered to facilitate the installation of apps from outside of Google Play and other preloaded stores.
