We all need some Safety net...

Android Safety net talk on Droidcon 2017 with some slides shown at Google cloud next 2017

Transcript

2. We all need some Safety net… Yossi Elkrief Mobile Lead, StreamElements twitter @elkriefy
4. ! Detecting abuse. ! Uses Google's APIs
6. SafetyNet Protecting Android users
 applying data driven security apps and services
16. Verify Apps
20. val verifyAppsEnabled = SafetyNet.getClient(this) .isVerifyAppsEnabled A }E
21. val verifyAppsEnabled = SafetyNet.getClient(this) .isVerifyAppsEnabled A verifyAppsEnabled.addOnCompleteListener { task -> if (task.isSuccessful) {B val result = task.result if (result.isVerifyAppsEnabled) { Log.d(TAG, "The Verify Apps feature is enabled.") } else {C Log.d(TAG, "The Verify Apps feature is disabled.") } } else { Log.e(TAG, "A general error occurred.") }D }E
22. val enableVerifyApps = SafetyNet.getClient(this) .enableVerifyApps() A }C
23. val enableVerifyApps = SafetyNet.getClient(this) .enableVerifyApps() A enableVerifyApps.addOnCompleteListener { task -> if (task.isSuccessful) {B val result = task.result if (result.isVerifyAppsEnabled) { //DO Something user agreed } else { //DO Something user declined } } else { //DO Something general error }}C
31. Let’s add SafetyNet Attestation API into our app!
32. val nonceData = "Droidcon IL Safety Net Sample: " + System.currentTimeMillis() val nonce = getRequestNonce(nonceData) val client = SafetyNet.getClient(this) val task = client.attest(nonce!!, BuildConfig.API_KEY) task.addOnSuccessListener(this, mSuccessListener) .addOnFailureListener(this, mFailureListener)
33. MaTriXy/SafetyNetSample
34. Sucessfully verified the signature of the attestation statement. The content of the attestation statement is: Nonce: [-54, 55, 98, -78, 80, 81, -113, 126, -58, 122, -91, 86, 61, 35, -63, -90, 122, 20, -44, 73, 17, -4, 82, 33, 83, 97, 102, 101, 116, 121, 32, 78, 101,116, 32, 83, 97, 109, 112, 108, 101, 58, 32, 49, 53, 49, 52, 50, 48, 57, 49, 57, 51, 56, 48, 54] Timestamp: 1514209197260 ms Result
35. APK package name: com.elkriefy.apps.android.safetynetsample APK digest SHA256: [-91, 2, -17, -32, 78, -93, 75, 84, 94, 82, 116, 37 , -103,-98, 49, -77, -89, 8, -118, -120, -42, 34, -67, -61, -39, 109, 104, -71, -32, 62, 71, -46] CTS profile match: true Basic integrity match: true Result ctd..
37. Determine whether a URL a known threat.
38. Determine whether a URL a known threat. Choose threat types important for your needs.
39. //Init safeBrowsing Tasks.await(SafetyNet.getClient(this@MainActivity).initSafeBrowsing())
40. initSafeBrowsing() Wait to Finish //Init safeBrowsing Tasks.await(SafetyNet.getClient(this@MainActivity).initSafeBrowsing())
41. //ShutDown Safe Browsing... SafetyNet.getClient(this).shutdownSafeBrowsing()
42. reCAPTCHA API
44. Thank You!