Assessing the Security Coverage of the Google Play Integrity API on Android - Vargas, Francis; Gaspar, Angelo; Kreutz, Diego; Mansilha, Rodrigo (Anais da Escola Regional de Redes de Computadores (ERRC), 2025)
This work evaluates the Google Play Integrity API using experiments across four attack scenarios: compromised environments, APK tampering, dynamic instrumentation, and request replay. The results show that the API correctly flags device and binary modifications but remains ineffective against runtime manipulation and replay attacks. We conclude that Play Integrity is useful as an integrity signal source but must be combined with server-side verification, nonces, and application hardening to provide meaningful protection in real Android applications.