9mo ago

Why don't banks like root on Android?

You're viewing a single thread.

186 comments

The reason is very simple: They rely on Google Safetynet (basically self-diagnosis). And that will immediately tell you off if it notices your device is rooted. And while you can have a lengthy discussion regarding whether this makes your phone less secure or not, this is another simple argument from Google's POV: The device has obviously been tampered with, we don't want to put any resources into covering this case. As far as we are concerned, you shouldn't use our OS like this.
So basically laziness.
- SafetyNet is dead.
  They rely on Play Integrity API.
  That covers:
  App Binary signatures App source corroboration - Was it actually installed from the Play Store? Android device attestation - Is it a genuine device powered by Google Play Services Malware detection - Google Play Protect is enabled and has not seen known malware signatures.
  They can choose to ignore any number of those but they do not. It's part of their security reporting requirements to use attestation I expect.
  Beyond that - a device that doesn't meet Play Integrity is more likely to be a malicious actor than it is to be a tech enthusiast with a rooted phone: One of them is far more prevalent than the other in terms of device usage.
  Android apps are trivial to reverse engineer, inject code into and generally manipulate. That lets apps like ReVanced work the way they do... but that also means that blue team developers have a lot more work to do to protect app code.
  Source - Android App Developer, worked on apps with high level security audits (like banking apps).
- The banking apps I've tried don't require SafetyNet, instead they use Android AOSP's basicIntegrity. The latter doesn't require certification by Google, but also checks whether the device is rooted and the bootloader is locked.
  This means custom ROM's on most devices won't pass basicIntegrity, as only Google Pixel, ~~OnePlus~~ and Fairphone allow for relocking the bootloader.
  
  OnePlus no longer supports that as of _ColorOS OxygenOS 12 unfortunately.
  
  That's a bummer. Seems like Google Pixel and Fairphone are the only ones left. I don't even know why manufacturers wouldn't allow for relocking or even unlocking of their phones. I can't imagine they make much money with user data and the phone is already paid for. Warranty claims shouldn't be much of an issue either, as modifications can be easily detected and it's likely not a relevant amount of people anyway.
  
  As I understand it, the stated purpose is to prevent supply chain attacks and ultimately possible damage to their brand. In practice many of these same vendors ship their own spyware and do not want it removed.

186 comments