Replace SafetyNet recommendations with up-to-date information

[SirionRazzer]

Since SafetyNet is deprecated (https://developer.android.com/training/safetynet/deprecation-timeline), I would like to update the relevant sections with up-to-date alternatives.This field seems to be coined as the app and device attestation or integrity control. Each major platform comes with a default solution, and there are alternative 3rd party solutions. While the features and functionality differ, the ultimate goal is to ensure that:

• Requests come from your genuine app
• Requests come from a genuine, untampered device
  Attestation helps minimize fraud both on the client and backend sides. Hence, this topic can be mapped to related ASVS requirements as this topic extends to the ASVS domain.

Parts for removal

• https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/#safetynet
• https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/#safetynet-attestation

Related MASVS 2.0 IDs

• MASVS-RESILIENCE-1 - The app validates the integrity of the platform.
• MASVS-RESILIENCE-2 - The app validates its integrity.

Upsides

• Protection from risky and fraudulent interactions
• Reduces attack surface
• Integrity verdicts can suggest the possible attack
• Enrollment protection

Downsides

• It may be network dependent
• May have a dependency on the integrity provider's web service, which may introduce some networking latency
• May have usage quotas
• Vendor-dependant platform support
• Proprietary algorithms

Providers

• Apple platform: DeviceCheck or App Attest
  • https://developer.apple.com/documentation/devicecheck
  • https://developer.apple.com/documentation/devicecheck/establishing_your_app_s_integrity
  • third-party providers
• Android platform:
  • Android with GMS: Play Integrity
    • https://developer.android.com/google/play/integrity/overview
    • Migration from SafetyNet: https://developer.android.com/google/play/integrity/migrate
      There is an unofficial community discussion about the Play Integrity and its quirks and features: https://forum.xda-developers.com/t/discussion-play-integrity-api.4479337/ .
  • Android with HMS: SafetyDetect
    • https://developer.huawei.com/consumer/en/doc/development/Security-Guides/dysintegritydevelopment-0000001050156331
  • third-party providers

[cpholguera]

This seems to be now:

#2770

#2774

Would you like to work on those weaknesses next @SirionRazzer?