As presented in Droidcon Tel Aviv 2017: http://il.droidcon.com

2. We all need some Safety net…
Yossi Elkrief
Mobile Lead, StreamElements
twitter @elkriefy

4. ! Detecting abuse.
! Uses Google's APIs

6. SafetyNet
Protecting Android users
applying data driven security apps and services

16. Verify Apps

20. val verifyAppsEnabled = SafetyNet.getClient(this)
.isVerifyAppsEnabled A
}E

21. val verifyAppsEnabled = SafetyNet.getClient(this)
.isVerifyAppsEnabled A
verifyAppsEnabled.addOnCompleteListener { task ->
if (task.isSuccessful) {B
val result = task.result
if (result.isVerifyAppsEnabled) {
Log.d(TAG, "The Verify Apps feature is enabled.")
} else {C
Log.d(TAG, "The Verify Apps feature is disabled.")
}
} else {
Log.e(TAG, "A general error occurred.")
}D
}E

22. val enableVerifyApps = SafetyNet.getClient(this)
.enableVerifyApps() A
}C

23. val enableVerifyApps = SafetyNet.getClient(this)
.enableVerifyApps() A
enableVerifyApps.addOnCompleteListener { task ->
if (task.isSuccessful) {B
val result = task.result
if (result.isVerifyAppsEnabled) {
//DO Something user agreed
} else {
//DO Something user declined
}
} else {
//DO Something general error
}}C

31. Let’s add
SafetyNet Attestation API
into our app!

32. val nonceData = "Droidcon IL Safety Net Sample: " + System.currentTimeMillis()
val nonce = getRequestNonce(nonceData)
val client = SafetyNet.getClient(this)
val task = client.attest(nonce!!, BuildConfig.API_KEY)
task.addOnSuccessListener(this, mSuccessListener)
.addOnFailureListener(this, mFailureListener)

33. MaTriXy/SafetyNetSample

34. Sucessfully verified the signature of the attestation statement.
The content of the attestation statement is:
Nonce: [-54, 55, 98, -78, 80, 81, -113, 126, -58, 122, -91, 86, 61, 35, -63,
-90, 122, 20, -44, 73, 17, -4, 82, 33, 83, 97, 102, 101, 116, 121, 32, 78, 101,116, 32,
83, 97, 109, 112, 108, 101, 58, 32, 49, 53, 49, 52, 50, 48, 57, 49, 57, 51, 56, 48, 54]
Timestamp: 1514209197260 ms
Result

35. APK package name: com.elkriefy.apps.android.safetynetsample
APK digest SHA256: [-91, 2, -17, -32, 78, -93, 75, 84, 94, 82, 116, 37
, -103,-98, 49, -77, -89, 8, -118, -120, -42, 34, -67, -61, -39,
109, 104, -71, -32, 62, 71, -46]
CTS profile match: true
Basic integrity match: true
Result ctd..

37. Determine whether a URL a known threat.

38. Determine whether a URL a known threat.
Choose threat types important for your needs.

39. //Init safeBrowsing
Tasks.await(SafetyNet.getClient(this@MainActivity).initSafeBrowsing())

40. initSafeBrowsing() Wait to Finish
//Init safeBrowsing
Tasks.await(SafetyNet.getClient(this@MainActivity).initSafeBrowsing())

41. //ShutDown Safe Browsing...
SafetyNet.getClient(this).shutdownSafeBrowsing()

42. reCAPTCHA API

44. Thank You!