So here we go, after years of fun messing around using Magisk, it seems that Google FINALLY decided to "fix" SafetyNet to something useful, and that is to use key attestation to verify device status (after 3 years since introduced to Android's platform!)
From what we've seen so far, key attestation doesn't seem to be fully enforced yet, as devices with incompatible, potentially buggy(?) keymaster implementations (e.g. some OnePlus devices) that result in attest key cmd failures still pass SafetyNet regardless.
To hack this thing, you have to either find a vulnerability in TEE firmware (which will be patched ASAP once found) or hardware (less likely to happen) to break the cryptography.
Breaking TEE won't be easy, which is why many security researchers are actively working on it.
Breaking TEE won't be easy, which is why many security researchers are actively working on it.
We might be able to hack around temporarily by forcing key attestation failure, fake report keymaster version, manipulate cached check results etc, but all of them is meaningless after this change is fully deployed AND properly implemented.
Let's face it. Fun is over guys.
Let's face it. Fun is over guys.
