[Music]
foreign
thank you to be here for this talk hello
also to the people that are watching
this talk remotely
so I'm Roman Tomas I'm security engineer
at UL where I perform security
evaluation on mobile banking app
and I enjoy dealing with reverse
engineering and obfuscation mostly for
our Mobile in mobile application and I'm
also the author of leaf which is
library that can be used to manipulate
the executable formats but today I will
I will talk about Swift net which is a
component developed by Google to check
the Integrity of the device Android
device
and basically they need to de-wrap that
because on Android
you can access to the root privileged
quite easily compared to iOS where you
have to somehow find a vulnerability to
have a Jailbreak on Android the system
unable to get root as long as you
disable some security feature like the
bootloaders of secure boot
so it brings some concern about for
developer about knowing whether they are
running their application on a trusted
environment
and that's why Google developed its own
solution named safety net which aim at
checking the Integrity of the device so
when we talk about integrity we talk
about detecting whether the device has
been rooted whether the the system is a
custom firmware or even if it's an
emulator
and basically when you are a developer
you might want to know if you can trust
the device on which the application will
run because for instance for the video
game industry they don't want to run
their game on a device that has been
rooted because maybe it could enable to
easily cheat the application
also in the bank industry they they are
not allowed to run the banking app on a
device that has been rooted for instance
and it's not about
whether the developer would support the
device or not it's a certification that
said you can't run the application on a
rooted device so that's why they create
a safety net to check the Integrity of
the Android device because it's easy to
get food on Android device
so from a developer point of view you
have basically to provide two
information uh one is the API key of
safety net which is used to identify the
developer and the other parameter is a
numps which is used basically to avoid
some kind of attack like replay attack
and when the developer provides these
two information it will get the result
of the safety net attestation to one
callback I mean to call back if there is
a failure but mostly one in the case
where it's a success and safety net will
provide information about whether the
device can be considered as safe or not
so why doing this torque uh at bracket
Asia so because basically in 2017 there
were already a torque at black at Europe
about safety net and Colleen and John
presented some uh inner work of how
safety net is designed and they
mentioned also a component Droid guard
but they did not explain a lot about how
it is used and how it works
and by the time there were also magisk
which is the routing solution for
Android and that enabled to easily
bypass theft net so it's very well
designed and they they find some tricks
to basically enable to bypass theft net
like just by enabler a setting in the in
the in the application so it's very easy
to actually it was actually very easy to
to bypass the net thanks to Magics and
Magic sky
and Google did some improvement because
of this routing solution where basically
they
improved that net with some kind of
Hardware attestation which
leverage some Hardware feature of the
device uh to know whether the bootloader
has been unlocked or not which is which
can be a sign of a rooted device
and
um safety net will will provide two flag
basically to determine whether the
devices is safe or not the fourth one is
basic integrity and the second one is
the CTF profile match here are the
descriptions that are available on the
Google Website but basically the basic
Integrity check will determine whether
the device is rooted if it's an emulator
and if there are some presence of API
hooking like Freda and on the other end
CTF CTS profile match will do the same
more or less the same check as basic
Integrity but it will also detect if
your workloader is unlocked which is one
step to get food on an Android device
but the important Point here is that CTF
profile match will be set to false if
the device did not pass the Google
certification so it can bring some full
positive uh in the attestation
and back in January of this year the
main developer of magisk join Google and
because of some conflict of interest I
guess he decided to remove Magic's guide
from the release 24. so now in the
latest version of magic there is no
magic Island we can't use it to bypass
the the root detection of 30 net and
other rasp solution
so now if we go back to the snippet that
show how to use a safety net from a
developer point of view now from a
system perspective
a safety net the developer will will
trigger a safety net request through the
safety net SDK that takes place in the
blue area
the safety net SDK will will craft a
message that will contain basic
information about the application that
ask for the request it will forward this
information through an intent to DMS car
GMS car on Android is is a component
that contains all the Google logic uh on
the device this component GMS score will
perform some very classical root check
on the device so if we check if for
instance the Su binary is present
and it will start also to create a
protobuf message that will contain the
information about the Integrity of the
device
then GMS score will call Droid guard
which is another component that runs in
another process but that is very close
in terms of communication I would say to
a GMS Curve droidguard will perform the
AV check to determine whether your
device is is safe or not I mean if the
device has been rooted if it's an
emulator and so on so most of the check
of setting net are done through Droid
gel then Droid guard will send the razor
to GMS curve that would throw up the the
information to the Google backend and
the Google backend will decide which
flag to set to false or true
so here is uh the protobuf message that
is created by
um by GMS score so in The Orange Box you
have the basic information about the
application that ask for the attestation
you have also uh some information about
the
small and easy checkfruit and else LC
Linux status so here it's just about
Java check so it's not obfuscated it's I
mean you have to reverse the GMS APK but
it's very straightforward to notify and
on the other end uh Droid guard the
result of Joy gut will be happen to this
message
and will it contains some a blob of data
which looks like a blob of data that it
actually contains a lot of information
about the statues of the device
this protograph message is sent to the
Google backend that will do some
computation to determine the results of
the safety net request
so the goal of this talk is mostly to
present Droid guard which is a heavy
model that contain different kind of
different layer of obfuscation
and in particular the normal of this
talk is not to present a new technique
to bypassive net because it's not a verb
proportion just to provide a description
of how it works
so the question now is
how this value generated through Joy
guard is actually generated and what
kind of information it contains
so as I said quickly uh just before
Droid Garner run in a different process
than GMS score so the name of the
process is com Android Google GMS
unstable and it's associated with an APK
that is located in the data partition of
the of the application
actually this APK is dynamically
downloaded from the Google server so
it's not an APK that is already
installed on the system it's an APK that
is updated every two weeks and that
contain a small Java layer and a native
Library written in C plus plus that
Implement somehow a VM
and this VM is heavily obfuscated with
different kind of different layers that
I will describe a bit later and it
contained all the logic of the the
drawing card
so just to summarize a bit of the the
process of Joy guard so first GMS score
will trigger an event that will start
Droid guard then drill guard will run uh
the bike provided by the Java layer so
as I said Droid guard Implement a VM and
to use the VM you have to provide a
bytecode and this bytecode is actually
downloaded for each other station
so Droid guard starts with the Java
layer that you just choose to bridge uh
with a native layer that is located in
the native Library this native library
is obfuscated with MDA with on CD
burgundy hooking
all the buffer on Kodi I mean you have
different kind of layer of obscation
Droid guard also download the bytecode
for each attestation which means that
each time the developer asks for an
attestation Droid guard will download a
dedicated bytecode for the site station
so remember you have this APK that is
updated every two weeks
and the bytecode running through this VM
is downloaded each time
for each attestation and of course there
are some small modification for each
bytecode which can be difficult to
analyze because first when you reverse
the APK you have to be somehow quick
because every two weeks it change I mean
some part of the VM change and the
bytecode is downloaded each time then
the bad gun sorry the bite could run
through the VM
the bite cut contain actually all the
check to determine if it's an emulator
if it's uh if the device is rooted if
there are some uh hint about hooking
from Rock and sun
it will also generate the token name
Droid guard this token will be sent back
to the Droid guard main class uh in the
the APK and then it will be sent to GMS
score that will add this value to the
product message and that will be
eventually sent
to the Google backend
so if we want to understand how certain
Network we basically need to understand
how the VM is designed and how the byte
code what kind of info what kind of
action are done through this bytecode so
is a 40 minute turns and it's outlined a
month of research so I will just
describe some feature of the VM and you
can find more details in the white paper
so basically the VM is designed with a
256 registers that can contain a typed
value I mean register it's a virtual
register so it's basically a simple
Express structure that contains a type
and a value and the type can be a
pointer can be a double can be a gni
object it can be also a string and so on
and uh for each new version of uh Droid
guard they are changing the layout of
Android ID of this register which means
that basically if you manage to be
notify that in the version a of droid
guard an integer is associated with one
or three in the next version the integer
type will be associated with one
so that's one of the challenge when
reverse engineering Droid
here is an example that perform a right
operation in the VM so basically here is
the the function that we just write a
value uh in the VM register so on the
top
you have a mixed Boolean arithmetic
expression which is used basically to
encode or to decode a register value
because in the joygard VM all the value
of the register are encoded which means
that if somehow you manage to dump all
the register value you won't be able to
see what their what value they are
actually because all the value are
encoded and they are encoded through MBA
and the MBA are changing every two weeks
because of the VM update so here you
have the decoding part of the the
register value then here you have uh
basically the STD string Destructor
because as I said Droid guard is written
in simplest groups and there are some
optimizations that are done through STD
string and here it's the aligning of the
destructor of STD string here you have
on the right hand side Diablo education
of your dni object because basically
when you want to write a value in a
register of the VM you have to
disallocate the previous value
so here they are safely removing the
produce value and then on the bottom you
have a MBA that will encode the actual
value so here just to give you an idea
of how
it can looks like to reverse engineering
so basically in the drawing Gap VM you
have a dedicated Handler that can be
used to perform Cisco to perform
arithmetical operation to perform gni
called and so on and here is a basic
block that will initialize the the
different Handler so basically they are
storing a pointer into the VM object
so now regarding the execution of the by
code you have basically a sequence of VM
Handler that are used to perform some
computation or some check on the device
so the first Handler is used to read the
for instance a register then you will
you will reserve the symbol that is
associated with a buffer clock get time
and so on and basically all the sequence
is used to detect uh whether the device
is sorry whether the application is
under debugging because basically you
can compute the time between you the
first call to clock get time and the
second call to block date time you can
determine whether it takes too much time
on it so here you have a sequence of
Handler and you have the same for
instance with the cooking or to detect
to detect a root on the device
now about what kind of check are done to
detect food
so once we manage somehow to identify
the different Handler and we notify uh
how the byte code Works within the VM we
can try to Analyze This bytecode
so here is an example of
a sequence of of the die cut so actually
it's just a representation it's
I mean it's from reverse engineering
Dynamic analysis and so on but basically
there is an example where they are
checking whether the data local x-bin
exists so first they are calling the
read buffer VM Handler that decode the
string data local xbin and then they are
calling the cool function Handler that
will be used to perform a ciscal
associated with f access at so actually
F access at is not hard coded in the in
the in the VM it's just a result of the
execution of the bytecode
so among the different Czech to detect
uh if it's a rooted device we have the
classical one so data locality and PS3
and so on so nothing very fancy I will
say on this point uh same you have some
system property check so did just some
yeah some strings that can notify
and basically to determine whether there
are some presence of a happy eye looking
they are checking if some libraries are
present in the memory space of a Droid
gout so here is an example where they
are the checking if
they expose is present
so you have the same for free that I
learned for lips and organ and so on
the interesting point that I found when
reverse engineering this die cut is that
basically they are also able to detect
uh whether the device has been infected
with Pegasus so there is some kind of
iuc to detect if there are some presence
of pages which is can be quite rare
because it's not like the normal way of
rooting your device but they are able to
detect it
in addition to this check they are doing
some kind of telemetry to collect
information about the device and about
the environment and to send this
information to the Google backend that
will perform some Advent check and based
on this information so it's a kind of
trade-off to find between
checking if for instance this Library
are present during the execution where
you get basically a Boolean value true
or false and collecting information
about the environment of the device so
they are collecting information about
for instance the zygote process they are
collecting information about the system
properties related to the bootloader
they are also collecting information
about kernel info and so on but they
need to find a trade-off between
collecting everything which can be which
can cause a lot of data to send and
doing Boolean checked that can be
somehow easy to bypass because basically
if you manage to bypass the c-score
that's that's done so here you don't
know actually how it is really used
in the Google backend which is near mine
the basic integrity and the CTS profile
match
so here is another list of information
on the top here you have also the
certificate chain that is used to
perform the hardware attestation so the
hardware decision is not something very
magic in that net it's come from a
public API that developer can also use
and they are basically sending the world
certificate certification chain to the
Google backend that check that the chain
is is valid and has not been corrupted
and that helps the bootloader is log or
not
uh so to summarize uh Droid guard
collect different information about the
device by running a dedicated bytecode
uh in a VM that is updated every two
weeks and this final token is compiled
from Boolean check that verify whether
this file is present or not or if the
library is present in memory or not and
from Telemetry data
that basically are a collection of
information about the device and you
don't know exactly how it is used by the
Google backend
to to to check the Integrity of the
device
foreign
actually safety net and
use a design
on a VM and a bygone but actually Google
use this design to run different kind of
backgrounds so when I analyze the safety
net I was focused on a byte code that
aim at checking the Integrity of the
device but they are also able to run a
dedicated by God for instance to check
during the device enrollment with your
Google account whether you are a bot or
not for instance and there are there are
different byte code dedicated for
different action on the device so Droid
guard provide all the design to run
Google back Google by code on your
device
with different layer of obfuscation
now when one question is how much uh
what is the cost for it of this kind of
reverse engineering so definitely is
very difficult and I took several months
to it so I won't say it's very easy and
it's just a matter of two days no it
takes months and you have to deal with
the update you have to deal with
different layer of application so it's
not very easy and so I had to develop
some tools to do that I also use a
pre-bit tool like like qbdl for
simplifying the the MBR also use msint
that that is very efficient for
simplifying the MDA uh and I also
developed some dedicated tool for
instance to uh do some kind of code
lifting so instead of reverse
engineering a complex function
I just extract the piece of code that I
were interesting and I just run it
outside of dry garden doing so I was not
uh I did not have to reverse every
instruction basically I just have to run
the quite piece of code
so in terms of how many days weeks or
months it takes so I'm I did that on my
spare time during weekend and quite
early in the morning but if I would have
to give a number of weeks I would say
that just to get an overview of the VM
and to be able to to to
to play with the buy card it took me
more or less five weeks and on the top
of that you can add two weeks for
developing your tool set
and then once you have everything ready
in the end uh I managed to reverse a new
version of the VM in a couple of hours
so
safety net is well designed well
protected and it's difficult to reverse
but I manage to bypass the basic
integrative flag without my disk hide
regarding the CTF profile it involves
the bootloader statues and it's out it
was out of scope of my research
but uh now what are the limit of the
design of this net
first off the Droid guard run in a
dedicated process
that is different from the application
that ask for the request
which means that when they are saying
that they are able to detect a happy eye
hooking that's true but that's only true
in the process of droid guard they are
not able to detect for instance if an
attacker is running Freda in the hub
developer so all the check are done in a
dedicated process that is different from
the original process of the of the
application
that's why
when you are enabling enabling the magic
ID you just have to Target Two processed
by passive net the first one is GMS car
and the second one is the one that ends
with unstable and that is actually drag
out and that's these two process that
needs to be targeted because actually
Droid guard does not check the Integrity
of the original process they are doing
all the check within the dedicated
process associated with dwayegar
so just uh there are some kind of Easter
eggs when you are reverse engineering
the the bike card which are associated
with Drury guard hello and you have
fancy message but basically if you are
the ID after the email is unique so it
means that each time you are running the
bytecode there are the different email
address which means that they will be
able to notify your device when you send
an email to this address so that's why I
actually did not send an email to this
other resume even though I I contacted
Google to to share this different
research
last World about the hardware
attestation so actually as I said at the
beginning Google introduced Hardware
decision to to to
improve uh the way of how setting
Network because basically otherwise it
can be more or less easy to bypass and
actually automatic station is nothing uh
so it's not something magic it's just
this kind of code that is running
through the different Handler of the VM
but in the end the important point is
key star get certification which return
a certification that is likely signed by
a trusted component and more precisely
true Zone that contains the status of
the bootloader so the statues of the
book reader is signed on the hardware
part and is actually collected through
get certification that is a part of the
Telemetry data
so thank you for your attention I
uploaded some samples of the VM and the
bytecode on gay Tab and now I would be
very happy to to answer your question if
you have some thank you
[Music]