SafetyNet API

Last updated

The SafetyNet API [1] consists of several application programming interfaces (APIs) offered by the Google Play Services to support security sensitive applications and enforce DRM. Currently, these APIs include device integrity verification, app verification, recaptcha and web address verification. It is an extension of AVB2.0 and dm-verity.

Contents

Attestation

The SafetyNet Attestation API, [2] one of the APIs under the SafetyNet umbrella, provides verification that the integrity of the device is not compromised. [3] [4] [5] In practice, non-official ROMs such as LineageOS fail the hardware attestation and thus restrict the user from using a non-compliant ROM while being able to use third-party apps (mainly banking) that require the API. Due to this, some consider this a monopolistic practice deterring the entrance of competing mobile operating systems in the market. [6]

Attestation requires a network connection for Google Play Services to connect to Google servers and validate the hardware signatures. Amongst the checks, the API looks for bootloader unlock status, ROM signature and kernel strings. Upon successful checks, Google Play will mark the device as Certified.

The SafetyNet Attestation API (one of the four APIs under the SafetyNet umbrella) has been deprecated. [7] As of 6 October 2023, Google expects to fully replace it with the Play Integrity API by the end of January 2025. [7] [8] Like the SafetyNet APIs, the Play Integrity API is offered by Google Services and thus is not available on free Android environments (AOSP). Therefore, apps that require the API to be available may refuse to execute on AOSP builds.

See also

Related Research Articles

A software development kit (SDK) is a collection of software development tools in one installable package. They facilitate the creation of applications by having a compiler, debugger and sometimes a software framework. They are normally specific to a hardware platform and operating system combination. To create applications with advanced functionalities such as advertisements, push notifications, etc; most application software developers use specific software development kits.

Android is a mobile operating system based on a modified version of the Linux kernel and other open-source software, designed primarily for touchscreen mobile devices such as smartphones and tablets. Android is developed by a consortium of developers known as the Open Handset Alliance, though its most widely used version is primarily developed by Google. It was unveiled in November 2007, with the first commercial Android device, the HTC Dream, being launched in September 2008.

The Android Package with the file extension apk is the file format used by the Android operating system, and a number of other Android-based operating systems for distribution and installation of mobile apps, mobile games and middleware. A file using this format can be built from source code written in either Java or Kotlin.

Rooting is the process by which users of Android devices can attain privileged control over various subsystems of the device, usually smartphones and tablets. Because Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

<span class="mw-page-title-main">Android Beam</span> Former Android OS feature

Android Beam is a discontinued feature of the Android mobile operating system that allowed data to be transferred via near field communication (NFC). It allowed the rapid short-range exchange of web bookmarks, contact info, directions, YouTube videos, and other data. Android Beam was introduced in 2011 with Android Ice Cream Sandwich. This was improved after Google acquired Bump. By 2017, ComputerWorld included Android Beam in a list of "once-trumpeted features that quietly faded away", observing that "despite the admirable marketing effort, Beam never quite worked particularly well, and numerous other systems for sharing stuff proved to be simpler and more reliable."

<span class="mw-page-title-main">Android Cloud to Device Messaging</span> Defunct mobile notification service

Android Cloud to Device Messaging, or C2DM, is a defunct mobile notification service that was developed by Google and replaced by the Google Cloud Messaging service. It enabled developers to send data from servers to Android applications and Chrome extensions. C2DM originally launched in 2010 and was available beginning with version 2.2 of Android. On June 27, 2012, Google unveiled the Google Cloud Messaging service aimed at replacing C2DM, citing improvements to authentication and delivery, new API endpoints and messaging parameters, and the removal of API rate limits and maximum message sizes. Google announced official deprecation of the C2DM service in August 2012, and released documentation to assist developers with migrating to the new service. The C2DM service was discontinued for existing applications and completely shut down on October 20, 2015.

<span class="mw-page-title-main">Google Cloud Messaging</span> Mobile notification service

Google Cloud Messaging (GCM) was a mobile notification service developed by Google that enables third-party application developers to send notification data or information from developer-run servers to applications that target the Google Android Operating System, as well as applications or extensions developed for the Google Chrome internet browser. It was available to developers free of charge. The GCM Service was first announced in June 2012 as a successor to Google's now-defunct Android Cloud to Device Messaging (C2DM) service, citing improvements to authentication and delivery, new API endpoints and messaging parameters, and the removal of limitations on API send-rates and message sizes. It has been superseded by Google's Firebase Cloud Messaging (FCM) on May 29, 2019.

Samsung Knox is a proprietary security and management framework pre-installed on most Samsung mobile devices. Its primary purpose is to provide organizations with a toolset for managing work devices, such as employee mobile phones or interactive kiosks. Samsung Galaxy hardware, as well as software such as Secure Folder and Samsung Wallet, make use of the Knox framework.

<span class="mw-page-title-main">Android KitKat</span> Eleventh version of the Android operating system

Android KitKat is the codename for the eleventh Android mobile operating system, representing release version 4.4. Unveiled on September 3, 2013, KitKat focused primarily on optimizing the operating system for improved performance on entry-level devices with limited resources.

Google Play Services is a proprietary software package produced by Google for installation on Android devices. It consists of background services and libraries for use by mobile apps running on the device. When it was introduced in 2012, it provided access to the Google+ APIs and OAuth 2.0. It expanded to cover a variety of Google services, allowing applications to communicate with the services through common means.

<span class="mw-page-title-main">Android Lollipop</span> Fifth major version of the Android operating system

Android Lollipop is the fifth major version of the Android mobile operating system developed by Google and the 12th version of Android, spanning versions between 5.0 and 5.1.1.

<span class="mw-page-title-main">LineageOS</span> Free and open-source operating system based on Android

LineageOS is an Android-based operating system for smartphones, tablet computers, and set-top boxes, with mostly free and open-source software. It is the successor to CyanogenMod, from which it was forked in December 2016, when Cyanogen Inc. announced it was discontinuing development and shut down the infrastructure behind the project. Since Cyanogen Inc. retained the rights to the Cyanogen name, the project rebranded its fork as LineageOS.

<span class="mw-page-title-main">Google Pay (payment method)</span> Mobile payments platform developed by Google

Google Pay is a mobile payment service developed by Google to power in-app, online, and in-person contactless purchases on mobile devices, enabling users to make payments with Android phones, tablets, or watches. Users can authenticate via a PIN, passcode, or biometrics such as 3D face scanning or fingerprint recognition.

Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. WebAuthn credentials are sometimes referred to as passkeys.

HarmonyOS (HMOS) is a distributed operating system developed by Huawei for smartphones, tablets, smart TVs, smart watches, personal computers and other smart devices. It has a single real-time microkernel design in kernel mode with a single framework: the operating system derives from HarmonyOS NEXT, based on OpenHarmony operating system family that is the user mode of HarmonyOS NEXT system that takes full L0-L2 source code derived from LiteOS roots that selects suitable kernels from the kernel abstraction layer. The operating system was officially launched by Huawei in August 2019.

<span class="mw-page-title-main">GrapheneOS</span> Android-based mobile operating system

GrapheneOS is an Android-based, open source, privacy and security-focused mobile operating system for selected Google Pixel devices, including smartphones, tablets and foldables that is recommended by Edward Snowden.

<span class="mw-page-title-main">MicroG</span> Free and open-source alternative to Google Android libraries

MicroG is a free and open-source implementation of proprietary Google libraries that serves as a replacement for Google Play Services on the Android operating system. It is maintained by German developer Marvin Wißfeld. In a presentation, Wißfeld described microG as "the framework to create a fully-compatible Android distribution without any proprietary Google components".

<span class="mw-page-title-main">Huawei Mobile Services</span> Proprietary software service

Huawei Mobile Services (HMS) is a collection of proprietary services and high level application programming interfaces (APIs) developed by Huawei Technologies Co., Ltd. Its hub known as HMS Core serves as a toolkit for app development on Huawei devices. HMS is typically installed on Huawei devices on top of running HarmonyOS operating system, and on its earlier devices running the Android operating system with EMUI including devices already distributed with Google Mobile Services. Alongside, HMS Core Wear Engine for Android phones with lightweight based LiteOS wearable middleware app framework integration connectivity like notifications, status etc.

Umar Javeed, Sukarma Thapar, Aaqib Javeed vs. Google LLC and Ors. is a 2019 court case in which Google and Google India Private Limited were accused of abuse of dominance in the Android operating system in India. The Competition Commission of India found that Google abused its dominant position by requiring device manufacturers wishing to pre-install apps to adhere to a compatibility standard on Android.

<span class="mw-page-title-main">PixelExperience</span> Mobile operating system based on Android

PixelExperience is an open-sourced custom ROM, or Android distribution, based on the stock Android AOSP that aimed to provide a bloat-free, stock-android, Pixel-like experience to a wide range of Android devices. The project, initiated by a community of developers in 2017, focused on delivering a clean, minimalistic, and visually appealing user interface reminiscent of Google's Pixel devices. Pixel Experience was designed to be as close to stock Android as possible, with a focus on reliability, security, stability, performance, battery life, and useful customizations.

References

  1. "SafetyNet Overview". Android Developers.
  2. "SafetyNet Attestation API". Android Developers.
  3. Hoffman, Chris (4 February 2016). "SafetyNet Explained: Why Android Pay and Other Apps Don't Work on Rooted Devices". How-To Geek. Retrieved 2021-09-11.
  4. "Google's dreaded SafetyNet hardware check has been spotted in the wild". Android Police. 2020-06-29. Retrieved 2021-09-11.
  5. Ibrahim, Muhammad; Imran, Abdullah; Bianchi, Antonio (2021-06-24). "SafetyNOT". Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services. Virtual Event Wisconsin: ACM. pp. 150–162. doi: 10.1145/3458864.3466627 . ISBN   978-1-4503-8443-8.
  6. Schwab, Andreas; Echeverria, Pablo Arias (24 March 2022). "Time to restore fairness and contestability in digital markets". www.euractiv.com.
  7. 1 2 "SafetyNet Deprecation Timeline". Android Developers.Retrieved2023-10-06.
  8. "Migrating from the SafetyNet Attestation API | Google Play". Android Developers.