SafetyNOT

Abstract

Many apps performing security-sensitive tasks (e.g., online banking) attempt to verify the integrity of the device they are running in and the integrity of their own code. To ease this goal, Android provides an API, called the SafetyNet Attestation API, that can be used to detect if the device an app is running in is in a "safe" state (e.g., non-rooted) and if the app's code has not been modified (using, for instance, app repackaging). In this paper, we perform the first large-scale systematic analysis of the usage of the SafetyNet API. Our study identifies many common mistakes that app developers make when attempting to use this API. Specifically, we provide a systematic categorization of the possible misusages of this API, and we analyze how frequent each misuse is. Our results show that, for instance, more than half of the analyzed apps check SafetyNet results locally (as opposed to using a remote trusted server), rendering their checks trivially bypassable. Even more surprisingly, we found that none of the analyzed apps invoking the SafetyNet API uses it in a fully correct way. CCS CONCEPTS• Security and privacy → Software reverse engineering; Intrusion detection systems.

Unmasking the Veiled: A Comprehensive Analysis of Android Evasive Malware

“…It is worth noticing that, contrary to other SafetyNet services, the Attestation API requires an app to have a registered and valid API key on its Google website; however, this malicious sample demonstrates that the attackers can abuse "benign" security mechanisms. Moreover, our data confirms the findings of Ibrahim et al [53], showing that legitimate apps do not properly use SafetyNet services that would significantly improve their security posture.…”

AoT - Attack on Things: A security analysis of IoT firmware updates

“…SafetyNot [36] has shown the usage of regular expressions for fingerprinting Android APIs. We use a similar approach to fingerprint the SDKs and formulate regular expressions for each SDK.…”