A Data-Driven Evaluation of the Current Security State of Android Devices

Lukas

https://infosec.exchange/@rene_mobile/113431029855652363

NetRunner88

Citation from the site :

It is worth to be noted that only measurements which fulfill all requirements by the Google Play Integrity test are processed. These requirements include the MEETS_DEVICE_INTEGRITY check and the installed version of the application must be a Google Play Store known version.

Lukas

NetRunner88 I sent them a letter.

Hi, this app requires devices to pass MEETS_DEVICE_INTEGRITY. To pass it, your OS needs to be certified by Google which makes this check just a blessing from Google and nothing more.

Other two checks are fine, but the proper way to audit the integrity of the devices is docummented here: https://grapheneos.org/articles/attestation-compatibility-guide

Android's hardware attestation API is a lot more robust form of attestation than Play Integrity API and doesn't require OSs to be certified by Google, which is anti-competitive.