Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Google Integrity API update breaks universal safetynet fix #203

Closed
wiredroid opened this issue Jul 21, 2022 · 153 comments
Closed

New Google Integrity API update breaks universal safetynet fix #203

wiredroid opened this issue Jul 21, 2022 · 153 comments
Labels
bug Something isn't working

Comments

@wiredroid
Copy link

wiredroid commented Jul 21, 2022 •
edited

New Google Integrity API update breaks universal safetynet fix

Describe the bug
Google Play device is certified. YASNAC safety net passes. Google Pay is now Google Wallet which detects device as rooted regardless of safetynet pass status.

To reproduce
Steps to reproduce the behavior:

  1. Go to play store
  2. Update to Google Wallet
  3. Attempt to add payment method
  4. See error

Expected behavior
To be able to add payment method credit or debit card to new Google Wallet.

Screenshots
Screenshot_20220721-214651_Google Play services

Device info
Device model: Samsung Galaxy S22 Ultra SM-S908E Snapdragon
Android version: 12
ROM name/version: Stock rom with Magisk and TWRP
@wiredroid wiredroid added the bug Something isn't working label Jul 21, 2022
@Hryniuk1
Copy link

Hryniuk1 commented Jul 21, 2022 •
edited

"Google Play device is certified. YASNAC safety net fix passed. Google Pay is now Google Wallet which detects device as rooted regardless of safetynet pass status."
Same
Realme GT Master Edition, stock rom with magisk

@Supertommino
Copy link

Same with Oneplus nord, Android 12 stock with magisk

@louga31
Copy link

louga31 commented Jul 21, 2022

Got the same problem with Oneplus 9

@jd1900
Copy link

jd1900 commented Jul 21, 2022

It actually is not part of the Wallet app. Before updating I got a notification from the Google Pay app before updating.

IMG_20220721_172351_935

Them, I updated.
And also got the message.

IMG_20220721_172357_323

However, inside Wallet config it says that the phone meets the security standards.

In beer root everything works.

So it seems it relies in some kind of API from Google Play different from SafetyNet.

Weird.

IMG_20220721_172305_727

@k1gen
Copy link

k1gen commented Jul 21, 2022

Same issue with Pixel 4 on Android 12.1

@simi55
Copy link

simi55 commented Jul 21, 2022 •
edited

Same issue with Pixel 4a 5G on Android 11 (edit: and 12.1). Pixel 6 Pro on Android 12.1 is still working.

@jd1900
Copy link

jd1900 commented Jul 21, 2022

UPDATE FROM MY PREVIOUS COMMENT:

I've just tried paying with Google Wallet and I could pay without any problem. So the security standards info is right. They know but do nothing, yet...

@shymega
Copy link

shymega commented Jul 21, 2022

I only get this on Android 11. It's not present on Android 12 yet, but my suspicion is that Google is rolling this patch out gradually. I've noticed my Microsoft apps in my work profile spot root now, so I suspect this new method has been shared with other app manufacturers. I expect more disruption as the change rolls out.

@simi55
Copy link

simi55 commented Jul 21, 2022

I only get this on Android 11. It's not present on Android 12 yet,

I updated the Pixel 4a 5G to the latest 12.1. The problem still persists (I did not wipe).

@shymega
Copy link

shymega commented Jul 21, 2022

I think it's being rolled out gradually. Or maybe it's because I use Lineage on my Android 12 phone? It could be because you're using a Pixel device. I've noted that before I removed root as a safety measure on my Android 12 phone, all company apps and GPay were working normally.

@1nikolas
Copy link

1nikolas commented Jul 21, 2022 •
edited

I think this is not related to the Google Wallet upgrade. They just happened to push a Play Services update alongside the new Google Wallet which detects root better. Try downloading Netflix from Playstore :)

Screenshot_20220722-010452.jpg

@wiredroid
Copy link
Author

wiredroid commented Jul 21, 2022 via email

@wiredroid
Copy link
Author

wiredroid commented Jul 21, 2022 via email

@1nikolas
Copy link

1nikolas commented Jul 21, 2022 •
edited

It's because it's not safetynet

They are using this option on the Play Console

Screenshot_20220722_005656
Screenshot_20220722_011422

Which is this api

Never seen that might be new

@wiredroid
Copy link
Author

wiredroid commented Jul 21, 2022 via email •
edited

@1nikolas
Copy link

I made this simple test app, it tells you if your device passes the new Play Integrity API. Extract and install the apk

app-release.zip
(I might upload the source code sometime, the code is pretty junk right now)

You can use this to play around and see if anything changes without having to reinstall google pay

@HuskyDG
Copy link

HuskyDG commented Jul 22, 2022 •
edited

It seems to be unable to fix when Google completely replaces and enforces it.

@wiredroid
Copy link
Author

wiredroid commented Jul 22, 2022 via email

@jd1900
Copy link

jd1900 commented Jul 22, 2022

It's because it's not safetynet

They are using this option on the Play Console

Screenshot_20220722_005656 Screenshot_20220722_011422

Which is this api

Never seen that might be new

Are there any docs regarding what it implies internally? What kind of checks it performs?

@pbanj
Copy link

pbanj commented Jul 22, 2022

it has a different package name
image

my app hasnt said anything. im also using https://github.com/stylemessiah/GPay-SQLite-Fix/releases and hide my applist

@wiredroid
Copy link
Author

wiredroid commented Jul 22, 2022 via email

@IMgoRt IMgoRt mentioned this issue Jul 22, 2022
Closed
@aaronaan
Copy link

Same on S10+ android 12 beyond rom. I can download Netflix beta tho in Germany through Playstore
The "new" integrity check fails, tested with the app posted here and wallet also doesn't work

@xAffan
Copy link

xAffan commented Jul 22, 2022

These steps worked for me.

  1. Change fingerprint to pixel device (pixel 5 to be precise)
  2. Reboot
  3. Add play store to magisk hide list (all processes)
  4. Clear data of play store
  5. Reboot
  6. Open app and check
  7. ??? Profit

Some of the steps might be unnecessary so you are free to experiment.

@1nikolas
Copy link

Are there any docs regarding what it implies internally? What kind of checks it performs?

Yes. Google says "Does not meet requirements" means this:

The app is running on a device that has signs of attack (such as API hooking) or system compromise (such as being rooted), or the app is not running on a physical device (such as an emulator that does not pass Google Play integrity checks).
...
If you are having problems with your testing device meeting device integrity, make sure the factory ROM is installed (for example, by resetting the device) and that the bootloader is locked.

@HuskyDG
Copy link

HuskyDG commented Jul 22, 2022

API hooking (zygisk) or being rooted could be the problem

@1nikolas
Copy link

What I don't get is people changing device fingerprints to pass the Integrity API. Why would that work? Why would I have to change my fingerprint when I don't have a custom rom? Is it banned or something?

@HuskyDG
Copy link

HuskyDG commented Jul 22, 2022 •
edited

I guess Play Integrity is basically just rebranded Safetynet because when I create /data/local/tmp/su (which trigger Safetynet fails) also trigger Play Integrity to fail
As far as I tested:
MEETS_DEVICE_INTEGRITY = Pass ctsprofile & basicintegrity

@1nikolas
Copy link

I guess Play Integrity is basically just Safetynet because when I create /data/local/tmp/su (which trigger Safetynet fails) also trigger Play Integrity to fail

Yes but it should have extra stuff too..

I'm starting to think that Magisk's creator is behind all this. He started working as an Android security researcher at Google and he is incredibly talented at this kind of stuff. We never had such an aggressive api before

@anyuta1166
Copy link

@anyuta1166 as far as I understand, changing the fingerprint to an older android version makes gms think that it can't do all the new checks (which are not availabe on older Android versions) so it succeeds (using old checks)

This fingerprint (taken from the real device) passes DEVICE_INTEGRITY on non-rooted device and fails on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXU2BRE4:user/release-keys

This fingerprint (taken from another real device) passes DEVICE_INTEGRITY on non-rooted device and fails on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXS3BTI1:user/release-keys

But this fingerprint (bundled with MHPC) passes DEVICE_INTEGRITY on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXS2BRA2:user/release-keys

As you can see Android version is the same (7.1.1). The only difference is the firmware build number.

That's what confuses me.

@1nikolas
Copy link

1nikolas commented Aug 2, 2022

@anyuta1166 as far as I understand, changing the fingerprint to an older android version makes gms think that it can't do all the new checks (which are not availabe on older Android versions) so it succeeds (using old checks)

This fingerprint (taken from the real device) passes DEVICE_INTEGRITY on non-rooted device and fails on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXU2BRE4:user/release-keys

This fingerprint (taken from another real device) passes DEVICE_INTEGRITY on non-rooted device and fails on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXS3BTI1:user/release-keys

But this fingerprint (bundled with MHPC) passes DEVICE_INTEGRITY on the rooted device:
samsung/j5xnltexx/j5xnlte:7.1.1/NMF26X/J510FNXXS2BRA2:user/release-keys

As you can see Android version is the same (7.1.1). The only difference is the firmware build number.

That's what confuses me.

Yes, the tests are different depending on the version. If you use a7 fingerprint on >a7 it can't check correctly and passes. If you use a7 fingerprint on a7, it does the intended checks and doesn't pass. I'm not entirely sure about this but is sound like a reasonable explanation

@anyuta1166
Copy link

anyuta1166 commented Aug 2, 2022 •
edited

Yes, the tests are different depending on the version. If you use a7 fingerprint on >a7 it can't check correctly and passes. If you use a7 fingerprint on a7, it does the intended checks and doesn't pass. I'm not entirely sure about this but is sound like a reasonable explanation

I use a7 fingerprints on a7 and the point is that one fingerprint doesn't pass but another one passes.

@1nikolas
Copy link

1nikolas commented Aug 2, 2022

Yes, the tests are different depending on the version. If you use a7 fingerprint on >a7 it can't check correctly and passes. If you use a7 fingerprint on a7, it does the intended checks and doesn't pass. I'm not entirely sure about this but is sound like a reasonable explanation

I use a7 fingerprints on a7 and the point is that one fingerprint doesn't pass but another one passes.

Then I have no idea

@GladistonXD
Copy link

I use a7 fingerprints on a7 and the point is that one fingerprint doesn't pass but another one passes.

Maybe it's the version conflict, it can't have the same build number in the version installed after root, I don't know.

@Displax
Copy link
Contributor

Displax commented Aug 2, 2022 •
edited

I use a7 fingerprints on a7 and the point is that one fingerprint doesn't pass but another one passes.

I think Google has some whitelist/blacklist for some prints. Blacklist for some ROMs existed even for SafetyNet (https://android.googleapis.com/attestation/status).
Maybe for PIA there is something similar (not public).

@rapperskull
Copy link

rapperskull commented Aug 6, 2022 •
edited

Today I updated my GT 2 Pro and now I pass DEVICE_INTEGRITY too, and I was able to add a card to Google Wallet*. Looks like Google has to manually blacklist each fingerprint from using BASIC_INTEGRITY.
The fingerprint changed from
realme/RMX3301EEA/RED8ACL1:12/SKQ1.211019.001/S.GDPR.202206222118:user/release-keys
to
realme/RMX3301EEA/RED8ACL1:12/SKQ1.211019.001/S.GDPR.202207251001:user/release-keys

*Google Wallet still says that my device doesn't meet the requirements, but probably it's just because I didn't clear its data after the update.
EDIT: I cleared Google Play Services data and now my device meets the security requirements, and I can also find Netflix on the Play Store.
EDIT2: After 2 days, I'm not passing DEVICE_INTEGRITY anymore.

@darryllin darryllin mentioned this issue Aug 15, 2022
Closed
@Klusio19
Copy link

The app is finally public! I made it beta testing since I haven't tested it on much devices. If you find any problem, please open an issue here and I'll take a look at them once I return from holidays.

https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck

If you are curious, the possible outcomes I've seen are:

* 3 ticks (unrooted samsung)

* tick/tick/x (unrooted redmi note 4 with unlocked bootloader)

* x/tick/x (my rooted a11 op7t)

Rooted OnePlus 8T On Android 12 (OOS12). Used moded safetynet fix module from here: https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517. I used ONLY this module, did NOT use magisk Prop config module to spoof fingerprint.

✔️ MEETS_DEVICE_INTEGRITY
✔️ MEETS_BASIC_INTEGRITY
❌ MEETS_STRONG_INTEGRITY

Wallet and Netflix are working perfectly fine, Netflix is searchable in google play store too.

@1nikolas
Copy link

okay here me out. If someone doesn't find a proper solution to the integrity api thing we are screwed real bad.

I found a real world use case of the integrity api which makes the app's root check unhackable. Basically the integrity check is done 100% on a server and it is tied to the login request. This way it just won't let you log in if the integrity token you sent doesn't pass. And there is 0 way you can fake that token, everything in this is encrypted and tied to your device and the specific app.

Now imagine your bank does this (which will probably do once SafetyNet is discontinued in 2024 I think). The only option would be to unroot. Sighhh.. This reminds me of Apple: "Oh yeah we support right to repair but we charge the parts 2x the price of the in-store repair". Google supports the platform being open but at the same time they want to block every app you have if you try to mess with it.

@davwheat
Copy link

davwheat commented Aug 17, 2022 •
edited

Rooted OnePlus 8T On Android 12 (OOS12). Used moded safetynet fix module from here: https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517. I used ONLY this module, did NOT use magisk Prop config module to spoof fingerprint.

✔️ MEETS_DEVICE_INTEGRITY ✔️ MEETS_BASIC_INTEGRITY ❌ MEETS_STRONG_INTEGRITY

Wallet and Netflix are working perfectly fine, Netflix is searchable in google play store too.

Can confirm this modded SN Fix works for me on my Pixel 6 Pro on the new Android 13.

safetynet-fix-v2.3.1-MOD.zip

@denistrentini
Copy link

safetynet-fix-v2.3.1-MOD.zip worked perfectly for me. Using beyond rom v4.6

@neelchauhan
Copy link

neelchauhan commented Sep 5, 2022 •
edited

I noticed suddenly Google Pay didn't work even though Netflix is in the Play Store. GPay detected a "rooted" device when I attempted to pay at a Starbucks.

safetynet-fix-v2.3.1-MOD.zip also works for me when using GPay on a Pixel 6 running Android 13.

@kax17
Copy link

kax17 commented Sep 18, 2022

Rooted OnePlus 8T On Android 12 (OOS12). Used moded safetynet fix module from here: https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517. I used ONLY this module, did NOT use magisk Prop config module to spoof fingerprint.
✔️ MEETS_DEVICE_INTEGRITY ✔️ MEETS_BASIC_INTEGRITY ❌ MEETS_STRONG_INTEGRITY
Wallet and Netflix are working perfectly fine, Netflix is searchable in google play store too.

Can confirm this modded SN Fix works for me on my Pixel 6 Pro on the new Android 13.

safetynet-fix-v2.3.1-MOD.zip

How do you install this mod?

@1nikolas
Copy link

@kax17 remove any fingerprint changer module you might have, reboot, go to magisk modules, install from storage, choose the zip, reboot

@kax17
Copy link

kax17 commented Sep 18, 2022

@kax17 remove any fingerprint changer module you might have, reboot, go to magisk modules, install from storage, choose the zip, reboot

Thank you, it was appearing greyed out at first.

@caccarazza
Copy link

caccarazza commented Sep 21, 2022 •
edited

@kax17 it's still greyed out for me. Did you unistalled the old version ?

@Hi-ImKyle
Copy link

Hi-ImKyle commented Sep 21, 2022 •
edited

Neither the Original or Modded SN gets Wallet contactless allowed. Samsung S22 Ultra Android 12. Safety Net passes fine though.

EDIT: Forgot to clear playstore data, reporting certified now, but I just want google wallet tbh.

@LambdaSoft
Copy link

Can someone check if Xbox Game Pass now works on their device? I suspect they started checking for Strong Verify...

@L1nz01d
Copy link

L1nz01d commented Sep 23, 2022 via email

@LambdaSoft
Copy link

LambdaSoft commented Sep 23, 2022 •
edited

I have a OP6 which fails Strong Integrity. According to the Playstore, I can install Xbox Game Pass. Dunno if that helps. from my phone

I can install it, but when it launches, closes automatically.

@kax17
Copy link

kax17 commented Sep 23, 2022

I have a OP6 which fails Strong Integrity. According to the Playstore, I can install Xbox Game Pass. Dunno if that helps. from my phone

I can install it, but when it launches, closes automatically.

Just installed it and it launches without issues

@L1nz01d
Copy link

L1nz01d commented Sep 23, 2022 via email

@Fred-Vatin
Copy link

@Klusio19 wrote
Rooted OnePlus 8T On Android 12 (OOS12). Used moded safetynet fix module from here: https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517. I used ONLY this module, did NOT use magisk Prop config module to spoof fingerprint.

✔️ MEETS_DEVICE_INTEGRITY ✔️ MEETS_BASIC_INTEGRITY ❌ MEETS_STRONG_INTEGRITY

Wallet and Netflix are working perfectly fine, Netflix is searchable in google play store too.

Device Root ROM Android
OnePlus6 Magisk 25.2 (official) AICP 16.1 11

Magisk settings : (default) only Zygisk is ON
Enabled Modules : modded safetynet-fix from above link.

Before

Before installing modded safetynet-fix, the Play Integrity API checker was all red.

After

After installing it, cleared data from every play service and framework, reboot,

I got this error.

IMG_20221003_095313

My playstore version was revert back by the module to 28.3.16-21. The section to check certification is not available in settings. Google wallet and Netflix are now available in store.

Test

For testing purpose, I updated the playstore to see if it would solve the Play Integrity API checker error.
image

It took some time with no notification.

Now playstore version is 32.4.13-21. It still suggests to update but there is no newer version. After some time, the certification section displays. It passes.
image

After clearing data of Play Integrity API checker. No error and new result.
IMG_20221003_104843

SafetyNet Check app before and after installing the mod.

1 rooté
IMG_20221003_105044

Pretty straight forward solution.

@kdrag0n
Copy link
Owner

kdrag0n commented Oct 5, 2022

Duplicate of #204

@kdrag0n kdrag0n marked this as a duplicate of #204 Oct 5, 2022
@kdrag0n kdrag0n closed this as not planned Won't fix, can't repro, duplicate, stale Oct 5, 2022
@wiredroid
Copy link
Author

wiredroid commented Oct 11, 2022 via email

kdrag0n added a commit that referenced this issue Jan 6, 2023
@kdrag0n
Dynamically patch build fingerprint in GMS process
754d2c0 
"AndroidCAStore" always seems to be used early in the attestation
process, before the fingerprint is checked.

Dynamic patching avoids problems with device detection and functionality
that can be caused by permanently spoofing another device.

Fixes #207, #224, #222, #220, #218, #212, #211, #210, #204, #203, #201, #196, #188, #171, #170
kdrag0n added a commit that referenced this issue Jan 6, 2023
@kdrag0n
Dynamically patch build fingerprint in GMS process
73c8587 
"AndroidCAStore" always seems to be used early in the attestation
process, before the fingerprint is checked.

Dynamic patching avoids problems with device detection and functionality
that can be caused by permanently spoofing another device.

Closes #207, closes #224, closes #222, closes #220, closes #218, closes #212, closes #211, closes #210, closes #204, closes #203, closes #201, closes #196, closes #188, closes #171, closes #170
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests