Introducing Netflix Stethoscope

As if the user knows if they've been rooted by a malicious third party.

It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.

Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities.

I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.

its actually against the banks ToS to give your credit card to anyone else... even at the register.

but everyone ignores that :-P

The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.

> 1) Maybe I know what I'm doing (honestly .. I consider myself capable and still have cringe while writing this)

My example kinda covers this, phones really are getting faster... It's no longer a case of "I know what I'm doing" when it now comes down to human recognition and reaction time. In other words, you clicked allow before your brain had time to stop you. How do you prevent this?

> 2) Your software isn't immediately compromised in its core functionality if _I_ own my _own_ device.

100% agreed. For the Google Pay example, fair enough. It's your credit cards, and it's harder to come up with a counter point.. For the OP / Netfix example, it's not your data, and likely not your device - or - by connecting to company services, you've basically agreed it's not yours (This could be a whole sidetrack on it's own! :))

> Android Pay and whatever else might try to be your wallet (I'm a huge fan, as you might notice in this thread) should be able to withstand that. Otherwise it's just a crappy payment system.

Credit card companies are generally responsible for theft of money where you remained in possession of your card at all times. Sure, they really hate admitting it, and gathering the proof is hard, many times impossible. But that doesn't change the responsible party when the proof is found.. Given this, it's easier for them to accept less secure alternatives (e.g. the US's reliance on signatures).

The rise of NFC credit cards has changed this somewhat, if a credit card hands out all the details needed to make a purchase to anyone who bumps into you on the street, possession is now not the only factor, and banks have built safeguards around this (e.g. max transaction size, max NFC transactions before being required to enter your PIN).

Google with Android Pay must prevent that same bump on the street from stealing their customers money. The cell phone payment version of this comes in the form of other apps on the device, hackers breaking into the phone remotely, etc. With a rooted device, or a device using unknown firmware[1], all bets are off.

> I can pay stuff from my PC (various operating systems) and I do have root (or the equivalent permissions).

And this is a security hole, granted it's one I wouldn't want to see shutdown, but it's still security hole. I don't have any good answers here, but I do look forward to seeing a solution that works while letting me keep root access on my Linux box!

> Why is the CC secure, but a rooted phone isn't.

I'm think I've mostly covered this, but you're looking at two totally different landscapes. They just cant be compared in the same way.

> Ignore Netflix, they're brain-dead and content related DRM isn't what I'm going for.

While I'm no DRM fan, this entire article is about Netflix's corporate employee device security, it's nothing to do with DRM or content..

[1]: Unknown firmware in this case means firmware google doesn't trust - unrooted AOSP built from a unknown manufacturer can't be trusted any more than rooted firmware from Google itself.

May have nothing to do with it but paying with CC details pretty much always has some traceable chain to the person who is gaining from the fraudulent activity. Contactless payment does not. Therefore a contactless scam could yield higher gains with lower risk than traditional cc fraud, and this poses a huge risk to any payment providers.

> failed attempt to close the analog hole

Stethoscope has nothing to do with user's of Netflix's service, and the DRM on it. This is for Netflix employees, on IT managed smartphones. This could have just as easily come from any of a number of other companies that issue phones to employees.

The only argument I would make against your points 1 & 2 is that I as a developer can't assume that a person with a rooted device knows what they are doing. For instance... I have a number of friends that have purchased rooted devices for the sake of using things like Kodi, against my advice. They do not understand their devices, or why downloading movies that hit the theater that day is illegal b/c they legally downloaded Kodi or bought a Kodi device legally. I am constantly having to fix/wipe them because they dont even understand the basics of security, ( i.e. they click ok on every popup without reading them, etc). Fortunately they pay me as I have refused for many years now to give free support, even to family. Anyhow, whenever my friends buy phones and other media devices, they almost always without fail and without asking my advice, purchase rooted ones online. Hell, for all they know, those devices could have software on them specifically for keylogging, etc.. and they would never know. So yeah, you can't assume a rooted device is in the possession of a competent user.

Absolutely, 100% agree. I'd go further, and require a password or pin too.

But - they don't currently do this, and there's no way that I can think of to reliably, as a third party, validate SuperSU etc is actually doing this.

EDIT: Also, some users really are.. ill informed and gullible. I hate saying it, but a large number of employees even at a tech company will click accept after a quick popup that says "For best 3D performance, we need root access to use your phones graphics chip directly".

And this is one of the few reasons I envy iOS users, Apple shipped ad-blocking APIs of some kind (or did that actually come out yet/ever?)

Google will likely never do this :(

You can do this with an on-device VPN, which doesn't require root: https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md

The app is also on the Play Store, but the adblocking features are only in the Github version (presumably Google will not approve this functionality for Play Store apps).

Blizzard is continuously playing cat and mouse games to see if you are using bots or cheats for their games. Blizzard comes up with a bunch of anti-cheating checks and within days they all get defeated.

It's a never-ending task.

SafetyNet is pretty flexible. It actually isn't implemented inside any APK - "The SafetyNet service reaches out to a Google server and downloads a binary package with the code. It goes to great lengths to validate the integrity of the package, for example using hardcoded certificates (pinning). This binary package is essentially a JAR file that contains a classes.dex file with java bytecode. Play Services caches it in dalvik-cache (snet.dex) and loads it dynamically using reflection." [1].

I think right now the only way "around" it has been Magisk [2].

[1] https://koz.io/inside-safetynet/

[2] https://forum.xda-developers.com/apps/magisk/official-magisk...

I don't think that'd be necessary. Google's stated that SafetyNet's purpose is not excluding power-users, but ensuring the security model of the OS has not been compromised, in order to activate certain sensitive functions (e.g. Android Pay).

Given that developments in the root community are few but well-known, it'd only take a weekly visit to the XDA Developers forum by an intern to learn about any new rooting method, and not many resources to successfully block them.

No need for a complicated (and expensive) information gathering and mining rig _for SafetyNet_. Could they be gathering that information with other purposes? Given that Play Services de-facto has root powers within Android, maybe.

The sandbox has been good in that it hasn't let the Windows model of apps running rampant with admin privileges do whatever they want with your data. It's mostly prevented cross-app data access.

But that's not where it stops. You see, there's still plenty of great data they can grab when you blindly click accept on that permissions dialog. Contacts are grabbed by many applications, unique device identifiers, loading your app with ads, even grabbing GPS location are pretty much standard practice now.

These practices which used to be labeled spyware or adware and hunted down and removed are now the norm.

These apps grab this data and then throw it out onto the open internet, often over unencrypted connections to parties who you don't know or trust, who are often unrelated to the app developer almost entirely, most often just so some advertiser knows you play a certain game or live in a certain city.

It depends on your definition of security - if it's strictly clicking on an ad and getting malware - it's great - but if it includes things like leaking contacts, locations and identifying information - it's terrible. XPrivacy is the only solution I've seen to really hit back at it.

Rooting your device does NOT immediately lose all sandbox benefits. It only selectively bypasses it. If you don't approve EvilMalware to bypass the sandbox - it still can't break out.

As for Android Pay? Go ahead and use it. Rooted or not, to my understanding, you're not liable for fraud on it, your credit card company will still reverse transactions no problem.

Yeah, so it depends on the way they detect it. You can bypass anything, even Google SafetyNet with stock ROM + magisk + systemless Xposed + phh su and using Magisk Hide if you're determined enough.

CM ships pre-rooted - you just enable it in the settings, but the su binary is present and can be detected by any app looking for it. So that's a very common way to detect it on CM.

Sure, so detect that as the problem.

That's not true of rooted Android devices though, most Android devices allow you to enable a developer mode which will allow you to replace the ROM entirely if you like with no need to exploit anything.

Presumably you use something to manage which apps get root access. Or is there actually malware that doesn't require any user screw ups?

On Android, the standard root system most people apply to their device prompts you when you launch an application if you want to allow it root access. This makes it trivial to block malicious applications - that new game you downloaded probably doesn't need root for any good reason. Just hit deny. The sandbox is still fully in place, just now you can poke holes in it for certain applications of your choosing.

What you're thinking of are things which use exploits to gain root - this may be done by some users, but most often Android devices are rooted via bootloader unlocking these days, which does _not_ use an exploit.

Exploits however are used by malware - and not having your device rooted won't prevent them. They gain root via exploitation, whether you want them to or not.

Not to mention that the kind of root detection done is by looking for things that only the legitimate sort of root leaves behind, like a su binary which prompts the user if they want to permit root or not.

Often times, rooting your device legitimately may allow you to flash a custom ROM and get updates that your original vendor hasn't released for your device, allowing you to actually _prevent_ exploitation by malware, even after your vendor has long abandoned the device.

I'm not using the extension, it is the remote server that is redirecting to https, not the local browser.

Their new entirely-JS based layout only happened after Google bought them.

Before that, Blogger's sites were completely degradable and perfectly functional without Javascript enabled. Then Google decided to remake all the templates to be fully JS driven and added a ton of page weight to the site.

That's fair, but it sounds like you're running an older Android version? In this case, your blame should lie with Google's old permissions model being not-fined-grained enough rather than at anger with Netflix over the permissions. Given the constraints on making the app, in order to satisfy you (no new permissions) they would have to halt feature development for things that customers demand, like offline play.

You can upgrade your Android version possibly, to find that the Netflix app will not require those permissions if you install it.

You are not on Android 7 yet. Prior to "Nougat" the fine grain permissions control was not available so permissions were an all or nothing thing at install time. Starting with version 7 you only enable a specific permission the first time the application needs it. And you can change them later if you wish on the permissions section of the application in app manager.

https://goo.gl/photos/2rvYmX6WNgGVfEsJ7

Even if you barely know the language, I've found it beneficial to listen to foreign language audio with subtitles (YMMV). It mean that when I actually try to learn parts of the language, I already have somewhat of a feel for it, so what I'm learning solidifies into something usable more quickly, and I don't spend as much time stumbling with pronunciations/verb conjugations etc.

The giraffe feels like it's asking you to lie down on the table and relax, in the same way that Hannibal Lecter might.

> if you know what you're doing

And if you don't, it's potentially much worse security. If your device is rooted, that's an attack vector that didn't previously exist. Since this tool is about informing and not enforcing, then if you really do know what you're doing then you can choose to take no action. If, however, you're not aware of the risks rooting a device exposes you too, then the tool provides an opportunity to learn that.

Further, this tool wasn't made with protecting an individual so much as protecting an organization. Yeah, you know what you're doing, but are you willing to bet your organization's security on that being true for everyone now and in the future? One compromised device can be all it takes for an attacker to get in. Not everyone who roots really knows what they're doing, it's very easy to root some phones, a quick download on a PC, run an app, click a button, and tada! Also, what about the non-techie person that asks their tech-savvy friend to root because they want to be able to <any single one of the things rooting allows>? Do you trust the judgement of every person tech-savvy enough to do this to never root another's phone without them really understanding the consequences?

</rambling>