Inside Android's SafetyNet Attestation

on YouTube ↗01h 01m

" summary

Explains how Google’s SafetyNet Attestation service assesses Android devices for OS tampering and integrity. Covers the SafetyNet platform and the attestation API that app developers can call to learn Google’s assessment of a device’s security state.

AI-written summary · about

" chapters (42)

1. 0:00Intro
2. 4:01Attack patterns
3. 4:14OS modification methods
4. 5:03Device integrity detection the old Days
5. 5:55That's a low bar
6. 6:34Hardcoded checks
7. 7:40Attackers can easily disable detections
8. 8:07Attackers can easily feed checkers with bad data
9. 11:21SafetyNet details
10. 14:14caveats
11. 15:11Criticism
12. 16:17SafetyNet JAR
13. 17:35SafetyNet modules
14. 18:33Example: device_state
15. 18:47SafetyNet Attestation: Overview
16. 19:48SafetyNet Attestation: Call Chain
17. 19:58SafetyNet Attestation: Request Attestation
18. 20:56SafetyNet Attestation Overview: Request Attestation
19. 21:19SafetyNet Attestation: Attest Device & App
20. 22:11Ideal implementation
21. 23:13Attestation result validation
22. 24:27Check crypto!
23. 26:00cts Profile Match & basicIntegrity
24. 27:24SafetyNet and the Nonce
25. 27:49Handle errors!
26. 29:36Attestation: just an API Call away!?
27. 31:44API Failures...
28. 32:48Howto: App/APK Integrity
29. 35:25Implementation & Deployment Summary
30. 36:39SafetyNet vs. Android Versions
31. 38:01Android 4
32. 39:51Boot Loader Unlocked
33. 40:21Client-side response validation?
34. 40:47SuHide and Magisk
35. 43:24SafetyNet's Application Integrity Checks
36. 44:52Running Code on Android
37. 46:17ODEX Code Modification Attack: Overview (Generic)
38. 47:32Attacking ODEX files: all Android Versions
39. 48:09Attacking ODEX files without Root (Android 6)
40. 54:50ODEX file Attack via Dirtycow
41. 55:23Attack Impact
42. 55:54Fun time

" related talks

• 25mHarsher Device Checks from SafetyNet AttestationAkihiro Shiota · DroidKaigi 2021
• 14mDemystifying attestationTodd Burner · Android Dev Summit 2022
• 39mAndroid App Security FundamentalsAndrea Cioccarelli · droidcon Italy 2022
• 30mDroidGuard: A Deep Dive into SafetyNetRomain Thomas · Black Hat Asia 2022
• 39mO-mg what's new in Android Security?Scott Alexander-Bown · droidcon NYC 2017
• 07mIntroducing Play Integrity API developer previewDom Elliott, Solène Maître · Google for Games Developer Summit 2021
• 43mWhat’s NNNNNNNNew in Android Security?Scott Alexander · Droidcon Italy 2017
• 28mAndroid boot verification to ensure integrity of OS and parti…Prashant Pol · DroidKaigi 2023