What is Rooting of Mobile Device
Rooting is the act of obtaining root or administrative access to the Android operating system, which is typically restricted for security reasons. When a device is rooted, the user gains superuser privileges, allowing them to access and modify system files and settings that are normally inaccessible to regular users. By default, in Android devices, the superuser access is only limited to the OEM's which has implemented the firmware.
If the device has been rooted, following things are possible:
- One can modify internal system configuration scripts.
- Alter or replace system-level applications.
- Rooting enables users to uninstall pre-installed applications (bloatware) that cannot be removed on unrooted devices.
- Users can employ ad-blocking software to prevent ads from displaying in apps and browsers.
- Install applications that execute close to the Android system and can execute operations that change the nature of the system which is not possible on a normal Android user when compared to the superuser access e.g., Magisk or Xposed modules.
- Intercept the normal workflow of an application and modify its internal working principle and bypass security checks such as API mocking, Geofencing protection, Paid License faking and extension of validity, etc.
So, why are rooted devices dangerous for sensitive mobile applications?
1. Compromise in basic security infrastructure of the application such as authentication, E2E encryption, DRM check, License validation, etc.
2. Risk of confidential information theft such as server secret keys, user credentials, server SSL certificates, etc.
3. The general business logic of the entire application can be tampered, leading to following attacks such as
- Injection of malicious code
- Privacy and user identify theft
4. By default the Android operating system and Google Play offers a basic layer of android app security protection to make sure malicious apps are prevented from installing in the device. Rooting the device will expose the opportunity to potentially bypass all the built-in checks.
5. User's will lose Android OTA updates such as general OS updates and Android security patches since the system has been tampered already and the OEM's security checks for illegal installations will kick in due to mismatch of checksum.
6. The stability of the device itself will decrease as the intended function of the device is now bypassed.
7. Certain devices will allow rooting only if the device bootloader is unlocked leading to permanent damage of the device, as certain hardware security features like Samsung KNOX will cease to work.
Therefore, applications that rely heavily on security will block rooted devices. This is taken very seriously in the financial domain as the loss of any sensitive information poses a serious risk to the reputation of the organization leading to legal issues.
Implementing Root Detection and Protecting your mobile apps
Programmatic Detection
1. If the superuser is enabled in the respective devices, it is highly likely that certain applications tend to be installed on the device. Therefore, detecting their application package name might help using the Android package manager.
com.thirdparty.superuser
eu.chainfire.supersu
com.noshufou.android.su
com.zachspong.temprootremovejb
com.ramdroid.appquarantine
com.topjohnwu.magisk
2. Check whether the SU path exists on the system PATH environment variable.
3. Check if the SU command executes in Runtime.getRuntime.exec
4. Play integrity API - This is the most recommended way to detect root
- If the basic integrity checks fail, then its highly likely that the device is rooted.
- ctsProfileMatch might indicate a custom ROM or an unlocked bootloader or an unapproved Android system that is not approved from Google.
5. Check for a custom build tag on OS
- If a custom firmware is installed, then the Android OS Build Tag will contain test-keys.
6. OTA updates will not work since Google cannot find the public certificates related to the new custom firmware as they are not attested by Google.
7. Ultimately the root by-pass mechanism is coming in the form of different tools and techniques. Which is ever-evolving. To cope with it, our recommendation is to implement RASP solutions relying on behavioural validation of root detection rather than signature validation.
AppProtectt offers advance security to Mobile Apps from rooted devices
AppProtectt by Protectt.ai implements runtime behavioural validation in identifying rooted devices and takes appropriate actions to protect the users from using the applications on compromised devices. With AppProtectt Root Detection, Android applications are safe from rooting tools and methods.
AppProtectt is the ideal state-of-the-art RASP Mobile App Security Platform that provides end-to-end protection.
AppProtectt ensures quick implementation and reduces TCO. AppProtectt , by Protectt.ai provides 360- degree security with 50+ cyber security features that enable Runtime Application Self Protection (RASP) for advanced detection and mitigation of all types of mobile threats – including prevention from App tampering to Reverse Engineering.
Stay protectt-ed!