Anbox - Run Android Applications and Games

From Kicksecure
Revision as of 12:49, 6 November 2022 by Nurmagoz (talk | contribs)
Jump to navigation Jump to search
Android OS Icon

Introduction

Anbox disables the majority of the Android security model [1] and it uses a very outdated Android version with known vulnerabilities. [2]

Anboxarchive.org iconarchive.today icon is a third party project that allows Android applications and mobile games to run inside Kicksecure. According to the Anbox website: [3]

Anbox puts the Android operating system into a container, abstracts hardware access and integrates core system services into a GNU/Linux system. Every Android application will be integrated with your operating system like any other native application. To achieve our goal we use standard Linux technologies like containers (LXC) to separate the Android operating system from the host. Any Android version is suitable for this approach and we try to keep up with the latest available version from the Android Open Source Project.

The project is open source and theoretically any application can be run. Anbox does not have direct access to a user's hardware or data. It should be noted that while it is possible to install the Google Play Store, Google will not allow anyone to ship applications if the device is not certified and the vendor has not signed an agreement. [4]

Info COMMUNITY SUPPORT ONLY : THIS WHOLE WIKI PAGE is only supported by the community. Kicksecure developers are very unlikely to provide free support for this content. See Community Support for further information, including implications and possible alternatives.

Security Specific

  • Do not use physical devices (mobile phones or tablets) for any kind of privacy activities because any physical device has a unique IMEI number which can be easily fetched by Android applications. Always use virtual devices such as Anbox or Waydroid or Android x86 for these kind of activities.
  • Always prefer using free and open source (FOSS) Android applications because they usually don't use any kind of surveillance. Using applications from F-Droidarchive.org iconarchive.today icon repositories is recommended.
  • Do not install Android Package Kits (APKs) directly from untrusted sources. [5]
  • Always check permissions before starting an application. Note the Android settings menu only allows the user to manage dangerous permissions (such as Camera, Storage, Location, Phone etc.) but not AppOps (application operations) permissions. ADB shell or extended GUI application/permission managerarchive.org iconarchive.today icon (root required) is needed in order to display and manage not only dangerous but AppOps permissions.
  • Do not store any private information inside Anbox or Waydroid or Android x86 filesystems.
  • As the Android system cannot prevent applications from accessing the Internet, additional firewall management is required. Android uses Linux iptables firewall manager so a GUI application like AFWall+archive.org iconarchive.today icon can be used to control what applications are allowed to access the Internet (root needed).
  • If a proprietary, non-free Android application installation is required An Aurora Storearchive.org iconarchive.today icon application can be useful for this purpose. Do not use any real (linked to your identity) account. [6]

General Issues

There are several issues with running popular Android applications using Anbox or Android x86 Workstation on top of a non-physical, certified Android device.

Unsupported CPU Architecture

Most popular Android applications (especially from Google Play Store) were written for ARMv7 and rarely for ARMv8 architectures. Therefore, some applications do not have support for x86 or x86_64 architectures. Android x86 users can use the libhoudini library in order to try to emulate ARMv7 architecture but many Android applications written for ARM still don't work.

Device Fingerprint

Many non-free, popular Android applications check the device fingerprint for hardware identification purposes. Anbox and Waydroid and Android x86 have emulator fingerprints so applications can easily detect that an emulator is in use. It is generally possible to spoof the device fingerprint, but it is necessary to rebuild the Android image for Anbox/Waydroid. Android x86 can utilize the Magisk module called MagiskHide Props Config in order to spoof the device fingerprint.

Network Interface Detection

Most popular Android applications detect network adapters and will not work properly if no Wi-Fi or mobile connection is established. Anbox/Waydroid uses a bridge network interface by default so some applications will not see the Internet connection. However, Android x86 starting from Nougat has a built-in virtual Wi-Fi interface so applications think that a real Wi-Fi connection is established.

Google Play Services Mechanisms

At present, the biggest problem with running popular Android applications on top of a non-physical Android device is passing SafetyNet by Google. Android consists of two parts:

  • The Android system itself (Android Open Source Project). This is a base system.
  • A proprietary subsystem called Google Play Services. This helps applications from Google Play Store to interact with Google servers. This is an optional subsystem but all Android devices which are certified by Google have this arrangement.

If only free software (FOSS) applications will be run, then Google Play Services is unneeded since all applications from F-Droid are built without a dependency upon Google Play Services. If some types of proprietary applications are needed, this can be problematic because some will use the Google Play Services mechanism.

Generally, Google Play Services consists of two important parts:

  • GCM (Google Cloud Messages)
  • SafetyNet

GCM is a proprietary mechanism for delivering Push Notifications from Google servers. GCM is used by ~70-80% of proprietary applications from Google Play Store which rely upon the mechanism. It is not difficult to enable GCM support for Android x86 and Anbox and Waydroid. The Android x86 image comes with built-in, non-free Google Play Services so GCM is enabled by default. With Anbox/Waydroid, it is possible to install either proprietary Google Play Services (OpenGAPPS) or an open-source implementation of Google Play Services called Micro-G.

SafetyNet is a mechanism which verifies the integrity of the device. If a device is not certified by Google Corporation then most of the proprietary Android applications from Google Play Store will not run because many use SafetyNet to check the device is authentic and has not been tampered with. Nowadays there is no way to pass SafetyNet on Android x86 or Anbox/Waydroid because Google uses its own closed-source algorithm for non-real devices detection. SafetyNet is used by ~30-50% of Google Play Store applications, especially those relating to banking and social networks such as Tinder.

Anbox inside Kicksecure Advantages and Disadvantages

There are both distinct advantages and disadvantages of running Android applications in Kicksecure. [7]

Table: Anbox Advantages and Disadvantages [8]

Category Notes
Bootloader / Ramdisk Anbox does not have any type of bootloader and ramdisk. Consequently it is impossible to install Magisk or some kind of recovery tool which is probably necessary for some operations like hiding root from applications (for example Magisk Hide).
Emulation No emulation is required, therefore Android applications can be run in a native Kicksecure environment.
Flexibility
  • It is easy to use Android Debug Bridge (adb) to install/remove applications and to push/pull files from/to the Anbox environment.
  • Root access - Anbox does not provide a superuser binary and manager. A manual installation of a superuser binary and application is required, which necessitates a rebuild of the Android image.
Networking Anbox does not provide a virtual Wi-Fi (wlan0) interface so some applications will not see the Internet connection.
Operating System Anbox is not full Android stack implementation or as full operating system similar to Android x86 workstation.
Software Anbox provides only Nougat android version.
Speed Android applications run faster in this configuration.

Footnotes

  1. ↑ For example it disables SELinux which is a core part of the security model; see https://github.com/anbox/platform_system_core/commit/71907fc5e7833866be6ae3c120c602974edf8322archive.org iconarchive.today icon
  2. ↑ See the dates on the Github repositories. https://github.com/anboxarchive.org iconarchive.today icon
  3. ↑ https://anbox.io/#aboutarchive.org iconarchive.today icon
  4. ↑ https://anbox.io/#faqarchive.org iconarchive.today icon
  5. ↑ do not download and install APKs from third-party websites because it can be dangerous.
  6. ↑ Note that most non-free applications from Google Play Store will not work properly without Google Play Services installed. Some will never work at all because an Android virtual device cannot pass Google's SafetyNet mechanism.
  7. ↑ https://forums.whonix.org/t/integrate-anbox-into-whonix-workstation/9642archive.org iconarchive.today icon
  8. ↑ The networking and software disadvantages below are very critical.
Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Anbox&oldid=64693"