Penetration Test Report (NCCGroup): NCC Group Google GOOG065C Report 2020 08 13 v2.0

Pixel 4/4XL and Pixel 4a ioXt Audit
Google
August 13, 2020 – Version 2.0
Preparedfor
EugeneLiderman
BillyLau
SamSchumacher
XeviMiroBruix
Preparedby
NCCGroupioXtCertificationLab
Executive Summary
OverviewandScope
NCCGroupwascontractedbyGoogletoconductasecurityassessmentofthePixel4,Pixel4XL,andPixel4adevices.
This assessment was specifically focused on determining whether the devices comply with the ioXt Android Profile
based on the ioXt Security Pledge.1 This assessment was performed between July 28 and August 7, 2020, and was
authorizedbyGoogle.
TheoverallassessmentmethodologyisdescribedindetailinioXtSecurityPledgeMethodologyonthefollowingpage,
andincludedatechnicalreviewcomparingtheproductdesignwiththepledgerequirements.
Thehardwaremodelnumbersandfirmwareversionswithinthescopeofthistestarelistedbelow:
• Pixel4
– Model: G020I/M/N
– Version: QD4A.200805.001
• Pixel4XL
– Model: G020P/Q/J
– Version: QD4A.200805.001
• Pixel4a
– Model: G025J/M/N
– Version: QD4A.200805.003forUSA,QD4A.200805.001forRoW
KeyFindings
TheioXtpledgecompliancesummariesforboththePixel4,Pixel4XL,andPixel4adevicecanbefoundinthefollowing
sectionsofthisdocument.
Limitations
This assessment, performed as part of the ioXt certification program,2 was a time-limited audit. These reviews are
focusedondeterminingthebasicsecurityhygieneoftheproductandthecompliancewiththeeightpledgeprinciples.
Furthermore,theAndroidioXtProfilereliesheavilyonpublicinformationaboutthedevicebeingtested,andleverages
theGMScertificationstatusoftheproductinordertodemonstrateevidenceformultipleioXtpledgecategories. The
Pixel4adevice,beingunreleasedatthetimeofthisassessment,wasnotofficiallyGMScertified,andsodidnotsatisfy
someoftheserequirements. Itwasunderstood,however,thatthePixel4awouldbesubjecttothesamerequirements
of previous devices including the Pixel 4, and that this device would be GMS certified prior to release. NCC Group
madenoteofthisinitssubmissiontotheioXtAlliance. Update: bythetimethisreportwaspublished,thePixel4a’sGMS
certificationwasalsopublished,andthatisnowreflectedinthetableandreferencesbelow.
ThisassessmentwasfocusedexclusivelyoncompliancewiththeioXtcertificationprogram,andwasnotfocusedon
identifyingplatformvulnerabilitiesbeyondthescopeofioXtrequirements.
1https://www.ioxtalliance.org/the-pledge
2https://www.ioxtalliance.org/get-ioxt-certified
2 | GooglePixel4/4XLandPixel4aioXtAudit NCCGroup
ioXt Security Pledge Methodology
TheioXtAllianceisagroupoftechnologyindustryleadersworkingtocreatepracticalstandardstosecureInternetof
Things(IoT)devices. TheioXtAlliancesecuritystandardsarebasedontheeightprinciplesstatedintheioXtSecurity
Pledge3:
1. Theproductshallnothaveauniversalpassword;uniquesecuritycredentialswillberequiredforoperation.
2. Allproductinterfacesshallbeappropriatelysecuredbythemanufacturer.
3. Productsecurityshallusestrong,proven,updatablecryptographyusingopen,peer-reviewedmethodsandalgo-
rithms.
4. Productsecurityshallbeappropriatelyenabledbydefaultbythemanufacturer.
5. Theproductshallonlysupportsignedsoftwareupdates.
6. Themanufacturershallactquicklytoapplytimelysecurityupdates.
7. Themanufacturershallimplementavulnerabilityreportingprogram,whichwillbeaddressedinatimelymanner.
8. Themanufacturershallbetransparentabouttheperiodoftimethatsecurityupdateswillbeprovided.
TheioXtAlliancedefinesmultipleprofilescorrespondingtovariousdeviceclasses,suchassmartspeakersandAndroid
devices. TheioXt2020BaseProfile4 definessecurityrequirementsapplicabletomostorallIoTdevices. Testcases
verifiedforcompliancewithioXtprofilesaredefinedintheioXtAllianceComplianceTestCaseLibrary.5 Therequire-
ments of the ioXt Android Profile 1.006 are effectively a superset of applicable requirements of the ioXt 2020 Base
Profile. However, BaseProfiletestcasesthatduplicaterequirementsforGoogleMobileServices(GMS)certification
are omitted to simplify the certification process. Devices certified under the ioXt Android Profile 1.00 must qualify
undertheGMScertificationprocess,orequivalent.
TheAndroidProfiledefinesasetofsecuritylevelsforeachpledgeitem,1beingtheminimumrequirementforcertifi-
cation,increasingwithadditionaltestsandrequirements.
TheGooglePixel4,Pixel4XL,andPixel4adeviceswereassessedagainsttheioXtAndroidProfile,version1.00,using
testcasesdefinedintheioXtAllianceComplianceTestCaseLibrary,version3.00.
UraniborgToolandPreloadedApplicationsRisk
The Android Device Security Database, a consortium consisting of researchers from the University of Cambridge
andJohannesKeplerUniversityLinz, createdariskscoringmethodologytoassessthecumulativeriskofpreloaded
applications on Androiddevices. This scoring system computes the overallrisk byquantifying and aggregatingthe
riskassociatedwithplatform-signedapplications,pre-grantedpermissionsonpreloadedapplications,andapplication
thatcommunicateusingcleartexttraffic.
Google, in partnership with the university consortium, developed and released Uraniborg, an open source tool to
automatetheanalysisoftheattributesofpreloadedapplicationsonanAndroiddevice.
NCC Group has reviewed the both the method and the implementation of this tool, and used it to determine the
preloadedapplicationriskoftheseevaluateddevices,whichisthecriteriafortherequirementsassociatedwithSecurity
byDefaultpledgeitemsummarizedinthesubsequentsections.
3https://www.ioxtalliance.org/the-pledge
4https://ioxtalliancemembers.org/wg/Compliance_wg/document/135
5https://ioxtalliancemembers.org/wg/Compliance_wg/document/134
6https://ioxtalliancemembers.org/wg/Compliance_wg/document/153
3 | GooglePixel4/4XLandPixel4aioXtAudit NCCGroup
Pixel4and4XL-ioXtPledgeComplianceSummary
Thissectionservestodocumentthedevices’compliancewiththeioXtAndroidProfile,7whichhasbeendefinedbythe
ioXtAlliance. TheioXtAlliancepublishesdevicecertificationsontheirwebsite.8
Principle Level Justification
Nouniversalpasswords 4/4 ThePixel4devicesatisfiesrequirementsthatthedevicebeGMScertified,
andNCCGroupreviewedasupplementalbiometriccompliancereport
establishingthestrongbiometricauthenticationmechanismsubjectto
AndroidCompatibilityDefinitionrequirements.
Securedinterfaces 3/3 ThePixel4deviceisGMScertified,satisfyingtheonlyrequirementinthis
category.
Provencryptography 3/3 ThePixel4devicesatisfiesrequirementsthatthedevicebeGMScertified
andthatitisontheNIAPapprovedlist.9
Signedsoftwareupdates 6/6 ThePixel4devicesatisfiesrequirementsthatthedevicebeGMScertified
andthattheaverageupdatetimeislessthan35days.
Automaticallyappliedupdates 5/5 ThePixel4devicemeetsrequirementsthatthedevicebeGMScertified,
thatthepatchinstallrateisgreaterthan70%,andthatupdatesare
automaticallydeployed.
Vulnerabilityreportingprogram 4/4 ThePixel4ispartofGoogle’srewardprogram.10 NCCGroupreviewedand
confirmedthisprogram’scompliancewithISO29417:2018(Section9.2).11
TheprogramwasfurtherdeterminedtocomplywiththeotherioXt
requirementsthattheprogramnotifyimpactedparties,acceptsexternal
submissions,andcoverssecurity-relevantcomponentswithinthePixel4
device.
Securityexpirationdate 3/4 ThePixel4devicesatisfiesrequirementsthatanendoflifepolicyis
published,andthatthreeyearsofsupport12areprovidedafterlaunch. The
highestlevel4wasnotsatisfiedbecausethedevicesupportwindowis
shorterthanfouryears.
Securitybydefault 4/4 ThePixel4deviceisGMScertified. NCCGroupreviewedtheresultsofthe
Uraniborgtool(ioXtSecurityPledgeMethodologyonthepreviouspage)
andestablishedthatthePixel4preloadsriskwaswasverylowwhen
consideredagainstthesetofover50Androiddevicesmeasuredbythis
tool.
7https://ioxtalliancemembers.org/wg/Compliance_wg/document/153
8https://compliance.ioxtalliance.org/products
9https://www.niap-ccevs.org/Product/Compliant.cfm?PID=11019?
10https://www.google.com/about/appsecurity/android-rewards/
11https://www.iso.org/standard/72311.html
12https://support.google.com/pixelphone/answer/4457705?hl=en
4 | GooglePixel4/4XLandPixel4aioXtAudit NCCGroup
Pixel4a-ioXtPledgeComplianceSummary
Thissectionservestodocumentthedevice’scompliancewiththeioXtAndroidProfile,13whichhasbeendefinedbythe
ioXtAlliance. TheioXtAlliancepublishesdev