Initial release of my Auditor app as an independent project: github.com/AndroidHardeni. It's also available on the Play Store as a free app: play.google.com/store/apps/det.
It provides hardware-based integrity and identity verification for a gradually expanding set of supported devices.
Conversation
It can be used to verify one of the supported devices from any Android 7+ device running another instance of the app.
It can also be used with my attestation.app service to schedule regular automatic verification. The service can send email alerts if anything goes wrong.
1
At the moment, the service supports sending email alerts if a device fails to provide a valid remote attestation within a configurable time period. In the future, it will support configuring alerts based on selected changes in information provided by hardware or software checks.
1
Every Android device launched with Android 8 or later has support for the minimum set of hardware security features. However, I need at least one person on each device model to use the 'Submit sample data' option in the app menu while using the stock OS with a locked bootloader.
1
1
1
It's harmless to get submissions from devices without the stock OS or without a locked bootloader, but it's not enough to add support for that device model.
I publish the sample attestation certificate chains and a subset of the system properties at github.com/AndroidHardeni.
