MicroG: A libre Google Apps and libraries’ replacement and their battle with SafetyNet

MicroG is a free and open replacement of Google’s proprietary Android user space apps and libraries.

Wait! Is not Android an open-source mobile OS already?

Yes and no. While, Android Open Source Product or AOSP is open as the name suggests but other components of the Operating System is not like Google Apps. So, one of the solution is not to ship or build an Android ROM with Google Apps and keep it completely open. It sounds like a plan on paper but Google has steadily confined most popular libraries and API to Android devices running core non-free or proprietary Google Apps. Even a few open-source Apps today reckon on these proprietary APIs by Google or other libraries and API that are only made available on devices with Google Apps pre-installed.

Google Apps is omnipotent on all the Android OS based devices shipped today because most Android Apps including some of the popular free/open Apps in the Android world do not function reliably without Google Apps that come with proprietary libraries and APIs.

Now the only tenable solution is to not use any of the Apps that uses Google Apps or even remotely reckon on it. The problem with this solution or scheme is that most of the banking or payment apps or popular communication apps that you use might fail to function or not work as advertized.

Hence, MicroG was born to develop a libre re-implementation of Google’s core Apps and libraries or components other than AOSP to let most of the Apps still work without Google Apps. It gives a lot of hope and opportunity to custom ROM developers and for devices that require after market support for updated version of Android OS.

Other than improved expectancy of support for dated Android devices, it brings a lot of privacy enhancements to the table. Users can now limit and watch amount of data being sent to the Google servers.

How does microG re-implement Google services in plain text?

It is reverse engineering, and before you ask, yes, microG connects back to the real Google servers for push notifications otherwise it won’t work, since server-side the notifications are all sent to Google. So, microG is not hosting different servers trying to spoof Google servers. For the location service, it does not connect to Google servers but has multiple options for backends. You could connect to Mozilla instead, to Apple, or just get the location with an on-disk database of phone towers. MicroG eliminates or minimizes information sent to google and other third parties from your device. Google Apps and their services do much more than just push notifications, and some of that you may not want, like ads and tracking. MicroG is the most pragmatic balance between privacy and functionality, provided you are willing to live with the limits.

MicroG as a project is putting in tireless hours to develop components like Service Core (GmsCore), a library app, providing the  functionality required to run apps that use Google Play Services or  Google Maps Android API (v2). Even a Google Play Store client called Store (Phonesky) is being developed. It is in early stages of work in progress. MicroG is attempting to obviate the requirement of Google Apps on an Android device while still being able to use most of the Android Apps. As of yet MicroG has succeeded in its core mission but all is not well because Google’s proprietary API and services like SafetyNet.

Google: SafetyNet provides a set of services and APIs that help protect your app against security threats, including device tampering, bad URLs, potentially harmful apps, and fake users.

From a pro user’s point of view, SafetyNet is an unofficial attempt by Google to prevent development and use custom ROMs. While, some of the Apps checks whether your phone is rooted or the boot-loader is unlocked and might not allow you to run their application if found true. The best test I believe is to run LineageOS without microG or Google Apps along with your favorite apps to be sure whether they are defunct without Google Apps and services. You might be surprised to find that your bank app doesn’t check for root or SafetyNet at all. While the official McDonalds app does not work as it looks for unlocked bootloader status.

Until recently, we could use Magisk Hide feature by Magisk that would hide or cloak both root and unlocked boot-loader from an Application by simply enabling it. But owing to recent changes in Google’s SafetyNet as per a tweet from March this year by developer of Magisk, John Wu, we might not soon be able to cloak unlocked bootloader from Apps. Google will now remotely check your SafetyNet status from its servers to verify device’s security which can get impossible to spoof for long, if ever.

Apps that use SafetyNet properly will most likely not work. No Android application explicitly checks for microG as it does not have nearly enough users to be relevant, but if they use SafetyNet to check for general modifications of the ROM, you probably won’t pass the test and not be able to run the application any more without Google Apps installed. It is not just unlocked boot-loader that is a key or primary check but other things like the signature of the ROM itself, the dm-verity status etc. So, other than maybe one or two Google devices with specific custom ROMs, nothing else will work if SafetyNet key attestation API is properly deployed.

In nutshell, SafetyNet with recent changes aims to check whether you are using stock ROM or not. It is obvious that it further wishes to mandate SafetyNet for most apps as a means to verify device integrity in name of security to force Google Play services to be installed on a given device. This is not a consumer friendly practice by Google.

As of now, SafetyNet is broken with microG unlike before. Even if it ever works again, I am not sure how that will act with the new hardware-based attestation. It is a well-planned attack on custom ROM communities world-wide. There is even a petition on Change.org to Google in order to revert these drastic changes back by a Mr Ashutosh SHAHANE. According to him, ‘This decision won’t do any good in terms of security as SafetyNet doesn’t work in case of vulnerability also hardware based attestation would effectively kill off the custom ROM community’.

Let us face the reality, Google’s Android and its SafetyNet technology is here to stay. Safetynet is designed to stifle development of custom Android ROMs, so it will be an uphill battle to circumvent that. The best thing would be if we can convince a majority of seasoned developers not to use it at all. It is really significant step. At least, free/libre community should step up and expunge use of SafetyNet from their Android applications. We cannot define how a profit making, data mining tech giant goes ahead with their own software. But, we can bring about a positive change in the free/open custom Android based ROMs community around the globe.