Network proxies like Burp Suite and mitmproxy are standard tools for mobile reverse engineering. But when analyzing Twitter's Android app, security researchers noticed something missing: the device attestation and integrity verification requests simply weren't there. No SSL pinning bypass could reveal them. Why? Because there was no network traffic to intercept.
The Invisible Layer: Binder IPC
Most mobile traffic interception assumes a standard model: App → TLS → Network → Proxy → Server. Twitter’s attestation flow completely bypasses this.
The critical exchange where the device proves it is legitimate happens between two processes on the same device, over Android’s Binder IPC mechanism:
com.android.vending).No TCP socket is created for the Google verification step. No proxy can observe it.
The Instrumentation Approach
To intercept this flow, researchers used Frida to hook the final mile of OkHttp. By targeting RealCall.execute, the payload could be captured just before hitting the network stack, after all custom interceptors had run.
However, the request body was obfuscated within a custom internal structure. Using Java reflection at runtime, the actual JSON payload was extracted, revealing a three-step warm-up and attestation process.
The Critical Formula: Deterministic Nonces
The most important finding of the research was how the nonce is generated. Typically, a nonce is a random UUID. However, the Play Integrity nonce sent to Google is cryptographically bound to the device's state.
Play Integrity nonce = Base64( SHA-256( attestation_object_json_string ) )This means:
- The nonce is deterministic, not random.
- Any modification to any field (
userId,deviceModel, etc.) changes the SHA-256 hash, invalidating the token. - Replay attacks are impossible because the server-generated UUID embedded within the attestation object changes every time.
The Huawei Experiment
To prove the absolute dependency on Google Play Services, the patched APK was tested on a Huawei P40 Lite—a device with Huawei Mobile Services (HMS) and zero Google components.
The result? The PlayCore SDK failed to bind to the ExpressIntegrityService. The server issued a fallback token, and the login attempt was outright denied with LoginError.AttestationDenied. This confirms that without the underlying Google infrastructure and the local IPC bridge, the Twitter app refuses to authenticate the client.
Credit
- Original article: Breaking the Black Box: Reverse Engineering Twitter’s Play Integrity Attestation Pipeline
- Original author: Berk Dedekargınoğlu
- Source: Medium
- Rewritten by: Lugon (TeguFy)