Everyone knows that in client-server systems, you can't trust the client. However, remote attestation gives us a way to change this. As Square provides financial services on unmanaged mobile devices, building more visibility into the client's runtime environment helps us fight fraud and offer unique features. In this talk I'll describe the systems we've developed to verify that our app is unmodified and running in a secure environment.

Naive client-side tampering checks are relatively easy to circumvent, since attackers can modify both the application and the OS. To counter this, we use a server-driven system that dynamically interrogates the client software. I'll discuss how we manage a rules system with hundreds of interdependent modules, build robust anomaly detection models without having any data from attackers, and support millions of devices running thousands of firmware versions. Our system has parallels with intrusion detection, hardware tamper detection, and systems combating spam, fraud, and abuse.