2

I discovered that we can use the Play integrity api instead of safetynet now to assure the integrity off an app that is running. I am wondering if people have a way of bypassing the "Genuine app binary"-aspect of this method. I could not find much information on how they check if the app is modified or not.

I would like to evaluate how secure it really is. Because if you would for example send a hash of your apk with your integrity api request, then the app could be patched to just send the correct hash value I think. Or does this login happen in the google play services?

Improve this question
1
  • In theory, it can be bypassed. An actor can replicate the behaviour of the client-side integrity component and fool the server into thinking the client binary is legitimate. Whether it's something that's going to be done in practice depends on the effectiveness of the implementation and whether it's worth doing for the actor.
    – ynwarcs
    Commented Dec 12, 2023 at 10:42

1 Answer 1

Reset to default
0

Q. Can some attacker bypass "Genuine App Binary" check ?

A. Well, yes and no.

Let's reframe the question first.

Q1.) Can some attacker spread cracked version of my app around if I enabled "Genuine App Binary" check ?

A. No. They can't. That's the benefit of App Integrity check. That is the level of security this protection provides. Often, you'll see cracked version of games being spread around. Your app won't be one of them. But, your app won't work on lot of Chinese phones since they don't ship with google play services. If you decided to provide a non-google play version, the protection will become useless. Google explains this in their docs.

Q2). How they check if app is modified or not ?

A. App Integrity check is a four-way communication. Your app, app server, Google Play Services & google servers.

Both your app & google check the signatures of each other. If attacker modifies your app, google services will pick the correct signature up & check will trip, and vis-versa. So, we can't just simply "patch" your app to send the correct signature hash. The payload is AES encrypted.

To get an idea of this protection, you can do this experiment: Install "Play Integrity API checker" from play store. Open it and click "Check", and after the results, click on "<>" button to see the response. Take a screenshot or note it down.

Now, just resign the app & install it. Try it again, it'll pass the first tests again. Click on "<>" to see response and screenshot/note it down.

Now, compare both responses. You'll notice that it'll fail some tests. "UNRECOGNIZED_VERSION", "UNEVALUATED" is what you'll see on some values instead of positive values. That's app integrity.

Source code of both the app itself & server is available on Github. Try tampering with them and try to pass those failed test. You'll slowly realize how this even works.

Q3). I still have doubts. Can we bypass this ?

A. Difficult question. How exactly do you want to bypass it ? It depends. Define "bypassing" what exactly, and I'll try to answer in comments.

Reference :- https://support.google.com/googleplay/android-developer/answer/10183279

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.