How Secure is your Android Keystore Authentication? (2024)

So we have the Android Keystore which is considered secure as we cannot access key material. However, an attacker might not actually need the key contents. The Keystore API could be used to retrieve key references, then they could be used to initialize theCipherobject and then they could be used to decrypt or encrypt application storage.

Yes, this is possible and most applications will be vulnerable to this class of attacks, as an attacker with physical access to the device or privileged malware can:

• Start the victim application
• Hook the victim application using Frida to execute code within context of the victim application which will do following:

1. Retrieve reference to theAndroidKeystorekey using Keystore API.
2. Initialize theCipherobject with the retrieved key reference.
3. Decrypt/Encrypt/Sign data within application storage.

Aaandgone!Android Keystore usage is not a binary security guarantee. In order to protect against this kind of attack developers have to mark the keystore keys as accessible only after:

• The device has been unlocked.
• Fingerprint or other biometrics have been validated.

For this configuration, the developer has to setsetUserAuthenticationRequired()totrueduring key generation. The other important property issetUserAuthenticationValidityDurationSeconds(). If it is set to -1 then the key can only be unlocked using Fingerprint or Biometrics. If it is set to any other value, the key can be unlocked using a device screenlock too.

In the case of a device screenlock, accessing a key is first done by callingKeyguardManager.createConfirmDeviceCredentialIntent().

It's important to note that theKeyguardManagerAPI does not give developers the ability to check what type of screen lock is configured or to verify a password/PIN/pattern policy. Therefore, the device can have an insecure screen lock like:

• Simple pattern (on most devices 3x3, could be guessed by trying common patterns or by inspecting finger streaks on the screen).
• Easy pin (usually 4-5 numbers, common patterns or trivial like 0000 or 1234).
• Guessable passwords (name of your dog).

Therefore it is advised that for highly sensitive applications like banking apps, password managers or secure messengerssetUserAuthenticationValidityDurationSeconds()should not have any value other than -1.

Thisscript can be used to trigger "device unlock" state usingKeyguardManagerand unlock keys that have not set a validity duration to -1.