Android 17 Brings ECH to the OS Level

Google has quietly rolled out a significant privacy upgrade in Android 17. The new version introduces support for Encrypted Client Hello (ECH), a standard that stops network providers from seeing which websites you visit. This isn’t just a browser tweak — it’s baked into the operating system itself.

For years, your internet service provider (ISP) could see the domain names of every site you accessed, even if the content was encrypted. ECH changes that by encrypting the part of the TLS handshake that reveals the server name. Now, with Android 17, that protection applies across the entire OS, not just in Chrome or Firefox.

The announcement came on Thursday, with Google positioning ECH as a cornerstone of its broader network security push. The company also highlighted efforts to shore up cellular vulnerabilities and protect home network privacy.

How ECH Works: The Technical Side

When you connect to a website, your device sends a TLS handshake that includes the domain name in plaintext. That’s how network providers know you’re visiting example.com even if the page itself is encrypted. ECH encrypts this handshake, so the server name is hidden from anyone sniffing the connection.

This is a big deal. DNS over HTTPS (DoH) and DNS over TLS (DoT) already hid your DNS queries, but the TLS handshake itself remained a leak. ECH closes that gap.

Android 17 implements ECH at the OS level, which means every app that uses the system’s network stack benefits automatically. You don’t need to configure anything or install a special browser. It just works.

What This Means for Your Privacy

For the average user, the practical effect is simple: your network provider can no longer build a profile of your browsing habits based on domain names. That’s a major win for privacy, especially on public Wi-Fi networks where snooping is easier.

It also matters for people in countries with strict internet censorship. ECH makes it harder for authorities to block access to specific sites, though it’s not a silver bullet — they can still block by IP address or use other techniques.

Beyond ECH: Other Security Upgrades in Android 17

ECH isn’t the only security feature in Android 17. Google also addressed cellular vulnerabilities that could expose your location or allow attackers to intercept calls. These fixes target the baseband processor, which handles radio communication and has historically been a weak point.

Home network privacy also got a boost. Android 17 now handles certain network configurations more securely, reducing the risk of man-in-the-middle attacks on your local network.

Here’s a quick rundown of what’s new:

• OS-wide ECH support for encrypted TLS handshakes
• Patches for cellular baseband vulnerabilities
• Improved home network privacy protections
• Seamless integration with existing apps — no developer action required

Why This Matters for Your Network Provider

Network providers have long relied on seeing domain names to throttle traffic, target ads, or comply with government requests. ECH undermines that visibility. Providers can still see your IP address and the amount of data you transfer, but they lose the ability to know exactly which sites you’re visiting.

That’s a significant shift. It’s also a reason why some ISPs have pushed back against ECH in the past, arguing it complicates network management and parental controls. Google’s decision to bake it into Android 17 suggests the company is prioritizing user privacy over carrier convenience.

If you’re concerned about your own setup, you might also want to explore how to change your DNS settings on Android for an extra layer of privacy, or check out the best VPN apps for Android to complement ECH.

How to Get Android 17 and ECH

Android 17 is rolling out now, but availability depends on your device. Pixel phones get it first, followed by other manufacturers. If you’re not sure whether your device has received the update, go to Settings > System > System update and check.

Once you’re on Android 17, ECH is enabled by default. There’s no toggle to flip or setting to hunt down. That’s the beauty of OS-level integration — it’s just there, protecting you without any effort.

For developers, the good news is you don’t need to change your apps. The system handles ECH transparently. If you’re building a network-heavy app, though, it’s worth testing to ensure everything still works as expected.

The Bottom Line

Android 17’s ECH support is a quiet but meaningful step forward for online privacy. It closes a long-standing gap in encrypted communications and does so in a way that requires zero user action. That’s rare in the security world, where the best protections often demand the most setup.

It’s not perfect — IP address leaks and other metadata remain — but it’s a solid improvement. If you value your privacy, updating to Android 17 is a no-brainer.

ATF Confirms Cyber Incident After Ransomware Group Claims Attack

The Bureau of Alcohol, Tobacco, Firearms and Explosives has confirmed it suffered a cybersecurity incident, responding to claims made by the Qilin ransomware group. The agency labeled the event a “major incident” and is investigating alongside the Department of Justice.

In a statement posted on its website, the ATF said the intrusion affected a standalone system, which was disconnected from the network once the breach was discovered. The agency was quick to clarify the scope: “The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system.”

Officials added that the incident has not hindered the agency’s ability to carry out its missions.

Qilin Ransomware Group Claims ATF Attack

The Qilin ransomware group added the ATF to its leak website on August 26. So far, the hackers have not made specific claims about what data, if any, was stolen. Typically, these groups post screenshots to prove they have exfiltrated certain types of documents, but that has not happened in this case.

Qilin’s post also lacks a countdown timer, which the group sometimes uses to indicate when stolen files will be published. The absence of both proof and a deadline leaves the true impact of the breach unclear.

Who Is the Qilin Ransomware Group?

Active since at least 2022, Qilin originally operated under the name Agenda. The group uses a double-extortion model: it encrypts files on victims’ systems and simultaneously exfiltrates sensitive information, threatening to leak the data if the ransom is not paid.

Qilin recently made headlines for exploiting a Check Point VPN zero-day vulnerability in its attacks. The group has listed more than 2,000 victims on its leak website to date, though the real number is likely far higher since many victims quietly pay the ransom and are never named.

Federal Response and Investigation

Senior Department officials have designated the event a “major incident” under applicable federal guidelines, and required notifications have been completed. The investigation is being conducted in coordination with the Justice Department.

This designation underscores the seriousness with which federal agencies treat ransomware attacks, especially those targeting law enforcement bodies. The ATF’s quick response—isolating the affected system—likely prevented broader damage.

What This Means for Federal Cybersecurity

The attack on the ATF is a reminder that no agency is immune to ransomware threats. Federal systems are high-value targets, and the Qilin group’s claim adds to a growing list of incidents involving government entities.

Related: Cl0p ransomware group names over 40 victims of PTC Windchill campaign

Related: Sensitive information exposed in Nutex Health data breach

Related: ReliaQuest confirms ShinyHunters hack, but says impact was limited

Timeline of Events

• August 26: Qilin adds ATF to its leak website, claiming an attack.
• August 28: ATF confirms the cyber incident, calls it a “major incident,” and announces a DOJ-coordinated investigation.
• Ongoing: The agency says the impacted system was disconnected and that no other systems were affected.

As the investigation unfolds, the cybersecurity community will be watching for any further claims from Qilin. For now, the ATF maintains that its operations are unaffected, but the full scope of the breach remains under review.

PaperCut Under Fire: Another Emergency Patch Lands

Malicious actors are actively exploiting a freshly patched security flaw in PaperCut NG and MF to execute arbitrary code on vulnerable instances. The company rolled out a new emergency fix with extra hardening on [date].

This isn’t a drill. The vulnerability gives an unauthenticated attacker remote control over PaperCut’s trusted configuration, which could be used to execute arbitrary Java code inside the application’s context. In plain terms: no login required, full system compromise possible.

Security researchers have observed attackers chaining two distinct flaws to bypass authentication entirely. The first is an authentication bypass in the external user lookup feature. The second is a path traversal that allows file uploads to unintended locations. Together, they form a lethal combination.

How the Exploit Chain Works

The attack sequence is deceptively simple. First, the attacker exploits the authentication bypass to gain access to the PaperCut admin interface without credentials. Then, they leverage the path traversal to upload a malicious JSP file to the web root.

Once the file is in place, the attacker triggers it remotely, executing arbitrary Java code. The result? Complete takeover of the print server, including access to sensitive print jobs and network credentials.

Here’s a breakdown of the two flaws:

• Authentication bypass (CVE-2023-27350): This flaw allows unauthenticated attackers to bypass the login screen and access admin functions.
• Path traversal (CVE-2023-27351): This enables attackers to upload files to arbitrary directories, including the web root.

Who’s Affected and What to Do

PaperCut NG and MF versions before 20.1.7, 21.2.11, and 22.0.9 are vulnerable. If you’re running any of these, you need to act now.

The company has released patches for all affected versions. The emergency fix also includes additional hardening measures to prevent similar attacks in the future. But patching is only half the battle.

Admins should also review their PaperCut logs for any suspicious activity, particularly around external user lookups and file uploads. If you see anything unusual, assume compromise and conduct a thorough investigation.

Immediate Steps to Take

1. Apply the latest PaperCut patch immediately.
2. Check for unauthorized admin accounts.
3. Review server logs for unusual file uploads.
4. Reset all admin passwords and service account credentials.
5. Consider restricting network access to the PaperCut server.

Don’t wait for a scheduled maintenance window. This exploit is already in the wild, and the window for safe patching is closing fast.

Why This Matters for Your Organization

Print servers are often overlooked in security assessments. They sit quietly on the network, but they hold a treasure trove of data. Print jobs can contain confidential documents, and the server itself often has access to domain credentials.

This attack chain is particularly dangerous because it requires no authentication. That means any attacker who can reach the PaperCut web interface can compromise the server. It’s not a matter of if, but when.

If you’re using PaperCut, treat this as a critical incident. The fix is available, but the clock is ticking.

Broader Implications for Print Server Security

This isn’t the first time PaperCut has been in the spotlight. Earlier this year, a separate vulnerability was exploited by ransomware groups. The pattern is clear: print servers are a prime target.

Why? Because they’re often neglected. They run on outdated software, with default credentials, and no monitoring. Attackers know this, and they’re exploiting it.

The takeaway for IT teams: treat print infrastructure with the same rigor as your servers and endpoints. Patch promptly, monitor logs, and segment the network to limit blast radius.

For more on securing your infrastructure, check out our guide on print server security best practices. And if you’re dealing with a suspected breach, our incident response checklist can help.

Stay vigilant. The attackers aren’t slowing down, and neither should you.