Discover the basics of SafetyNet Attestation and understand how does SafetyNet Attestation secures apps, what are their limitations?
In this hyperconnected world of digital devices, we are captives of interesting, useful, and entertaining applications that drive our days through nights. These applications are integral parts of the way we do business. The need, as well as the want for these apps, is ever-growing, and so are the efforts on the end of the Android developer community- to create flawless, dependable, user-friendly, and secure applications that smoothly function on Android devices, adding value to the end-user.
As the Android world gets bigger and wider, the impending threat of attacks on Android devices aggrandize. These threats are unpredictable, volatile and can not only damage the device operations but also hinder the performance of the apps on the device, painstakingly developed by Android developers across the globe. A compromise of these apps also opens up the vulnerable data associated with the app, bringing forth an undesirable situation for app developers as well as users.
To address this grave need for a security check for each device that attempts to run an app, Google introduced SafetyNet Attestation.
What is SafetyNet Attestation?
SafetyNet Attestation is an anti-abuse API that offers the ability to test and validate the integrity of the device that is attempting to run the application. When the SafetyNet Attestation API is included as a part of any app’s abuse detection system, it helps in determining whether the app servers are interacting with a genuine application on a genuine Android device. It helps in detecting device rooting along with assessing the overall integrity of the device.
SafetyNet Attestation helps in keeping the Android ecosystem in check, ensuring the app developers that their applications are running on a reliable device. Using SafetyNet Attestation, the Android app developers can obtain insights into the device, whether its OS is in a tampered state (as defined by Google) or the device security has been compromised and can take preventive actions against abuse and misbehavior.
SafetyNet Attestation mitigates the need to develop and reimplement hardcoded security checks that can be bypassed and root/tamper detection is easy and unfailing. SafetyNet Attestation helps in determining the overall integrity of the device.
Along with APIs, SafetyNet as a whole provides a set of services that ensure app protection against security threats such as bad URLs, harmful applications, device tampering, and fake users. These security assessments help in maintaining the application as well as device sanity, essentially securing critical data within the app and the device.
How does SafetyNet Attestation work?
SafetyNet Attestation API extends a cryptographically-signed attestation that assesses and evaluates the integrity of the device on which the app is running. It examines the software and hardware environment of the device, searches for integrity issues, matches it with the reference data provided for devices approved by Android, and generates a report of its findings to the app. This attestation is bound to a nonce provided by the app calling for SafetyNet Attestation and also contains a generation timestamp and associated metadata of the said application.
Let us learn how SafetyNet Attestation works for an app assessing a device’s integrity:
Step #1: When the device attempts to run your application, SafetyNet Attestation APU receives a call from the application with a nonce.
Step #2: The SafetyNet Attestation service examines the runtime environment of the device and requests a signed attestation of the evaluation from Google’s servers.
Step #3: Google’s servers sent the signed attestation to the SafetyNet Attestation service on the device.
Step #4: This signed attestation is returned to the app.
Step #5: This signed attestation is forwarded to your server by the app.
Step #6: The server validates the response and uses it to determine the anti-abuse decision, communicating the same to the app.
Step #7: The app can then determine whether it should trust and run on the device.
SafetyNet Attestation: Some Common Misconceptions
While SafetyNet Attestation API helps in automating a security and integrity check on Android devices running an application, it is not a standalone abuse detector or an app-security feature but has to be used with an appropriate product-specific, anti-abuse app security suite. It works only when the device is connected to the internet. When it is not connected to the internet, the API returns an error. It does not provide a fine-grain signal about system modifications but extends an overview of system integrity with boolean values. It doesn’t hence contain application-specific checks. While it is essential to have SafetyNet Attestation API, it cannot act as a replacement for DRM checks.
How to secure your application with SafetyNet Attestation API?
- Obtain an API key
- Request the desired quota for allotment
- Ensure the correct version of Google Play services is installed on the user’s device
- Obtain a nonce
- Request a SafetyNet attestation.
- Transfer the response to your server.
- Verify the response on your server, with your other anti-abuse signals and control app behavior.
SafetyNet Attestation API: The Limitations
For it to properly function and extend desirable results, the SafetyNet Attestation API needs to be implemented appropriately, considering the potential bypasses. There’s a whole lot of ambiguity and discussion on whether or not the SafetyNet can be bypassed. It will be difficult and expensive nonetheless, but the possibility of a bypass can never be fully eliminated. The app developers hence need to ensure that they have provisioned such unforeseen situations assuming the attestation is going to fail in certain scenarios and create an environment to handle such incidences.
SafetyNet Attestation is highly recommended to be included in an application’s anti-abuse strategy. Enterprises implementing a mobility strategy for Android devices are recommended to choose an MDM provider that includes SafetyNet Attestation. Scalefusion mobile device management includes SafetyNet Attestation while assessing policy enrollment on BYO devices, ensuring end-to-end security to critical corporate data on employee-owned devices. This assessment checks the device integrity and security to run and maintain critical work apps.
Secure your Android BYO devices with Scalefusion, today!
