Skip to main content
Information Security

Return to Question

Bumped by Community user
if you bold everything, you bold nothing
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

Root detection Implementation can be bypassed using Magisk hide  : Android App vulnerabilityhow to mitigate?

I have recently have been assigned a new security fix for my Android App:. This timeThe Vulnerability Assessment and Penetration Testing (VAPTVAPT) team usingused Magisk and Magisk hide to bypass the Android root detection implementation.

DescriptionThe description given by the VAPT team: Root detection is checked based on package name and availability of su binary.

"Root detection is checked based on package name and availability of su binary."

Hack they have done to bypass Root detection: What they did to bypass Root detection:

  1. Set Magisk application package name to random.package name to random.
  2. Next Apply Magisk hide settingsMagisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is thea rooted device.

Root detection implementation on App: Root detection implementation on App:

  1. Currently on Android App weWe have "Root Bear""Root Bear" and "Root Tool" library"Root Tool" libraries integrated for Root detection on Android device.
  2. All App data are stored in encrypted databaseencrypted database on Android App.

I have also checked possible wayways to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough. Here 

I found linklinks which sayssay they are able to bypass Safety net detection also:

  1. https://nooberinfo.com/magisk-hide-not-working-on-banking-apps-2021-magisk-hide-not-working-2021-android-11/#19-method-6-updating-magisk-to-magisk-canary-version-to-fix-safetynet-issue-in-android-11
  2. https://www.thecustomdroid.com/fix-safetynet-hardware-attestation-guide/

Questions regarding this scenario:

  1. In case if root detection is bypassed, Asas database is encrypted there there should be no chance toof any app data leak. If root detection is bypassed, is encypted database is secure enlugh to prevent app from data leak ?is an encrypted database secure enough to prevent app from leaking data?

  2. Is there any currently known mitigations available to detect Magisk and Magisk hidemitigations available to detect Magisk and Magisk hide on Android app?

  3. If Therethere is a new method to bypass and hide root then there is a need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new library for root detection ?Is it always a good idea to integrate new libraries for root detection?

Root detection Implementation can be bypassed using Magisk hide  : Android App vulnerability

I have recently have been assigned new security fix for my Android App: This time Vulnerability Assessment and Penetration Testing (VAPT) team using Magisk and Magisk hide to bypass the Android root detection implementation.

Description given by VAPT team: Root detection is checked based on package name and availability of su binary.

Hack they have done to bypass Root detection:

  1. Set Magisk application package name to random.
  2. Next Apply Magisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is the rooted device.

Root detection implementation on App:

  1. Currently on Android App we have "Root Bear" and "Root Tool" library integrated for Root detection on Android device.
  2. All App data are stored in encrypted database on Android App.

I have also checked possible way to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough. Here I found link which says they are able to bypass Safety net detection also:

  1. https://nooberinfo.com/magisk-hide-not-working-on-banking-apps-2021-magisk-hide-not-working-2021-android-11/#19-method-6-updating-magisk-to-magisk-canary-version-to-fix-safetynet-issue-in-android-11
  2. https://www.thecustomdroid.com/fix-safetynet-hardware-attestation-guide/

Questions regarding this scenario:

  1. In case if root detection is bypassed, As database is encrypted there should be no chance to any app data leak. If root detection is bypassed, is encypted database is secure enlugh to prevent app from data leak ?

  2. Is there any currently known mitigations available to detect Magisk and Magisk hide on Android app?

  3. If There is new method to bypass and hide root then there is need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new library for root detection ?

Root detection can be bypassed using Magisk hide: how to mitigate?

I have recently been assigned a new security fix for my Android App. The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection implementation.

The description given by the VAPT team:

"Root detection is checked based on package name and availability of su binary."

What they did to bypass Root detection:

  1. Set Magisk application package name to random.
  2. Apply Magisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is a rooted device.

Root detection implementation on App:

  1. We have "Root Bear" and "Root Tool" libraries integrated for Root detection on Android device.
  2. All App data are stored in encrypted database on Android App.

I have also checked possible ways to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough. 

I found links which say they are able to bypass Safety net detection also:

  1. https://nooberinfo.com/magisk-hide-not-working-on-banking-apps-2021-magisk-hide-not-working-2021-android-11/#19-method-6-updating-magisk-to-magisk-canary-version-to-fix-safetynet-issue-in-android-11
  2. https://www.thecustomdroid.com/fix-safetynet-hardware-attestation-guide/

Questions regarding this scenario:

  1. In case if root detection is bypassed, as database is encrypted there should be no chance of any app data leak. If root detection is bypassed, is an encrypted database secure enough to prevent app from leaking data?

  2. Is there any currently known mitigations available to detect Magisk and Magisk hide on Android app?

  3. If there is a new method to bypass and hide root then there is a need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new libraries for root detection?

Source Link
Pradip Tilala
Pradip Tilala
  • 131
  • 1
  • 3

Root detection Implementation can be bypassed using Magisk hide : Android App vulnerability

I have recently have been assigned new security fix for my Android App: This time Vulnerability Assessment and Penetration Testing (VAPT) team using Magisk and Magisk hide to bypass the Android root detection implementation.

Description given by VAPT team: Root detection is checked based on package name and availability of su binary.

Hack they have done to bypass Root detection:

  1. Set Magisk application package name to random.
  2. Next Apply Magisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is the rooted device.

Root detection implementation on App:

  1. Currently on Android App we have "Root Bear" and "Root Tool" library integrated for Root detection on Android device.
  2. All App data are stored in encrypted database on Android App.

I have also checked possible way to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough. Here I found link which says they are able to bypass Safety net detection also:

  1. https://nooberinfo.com/magisk-hide-not-working-on-banking-apps-2021-magisk-hide-not-working-2021-android-11/#19-method-6-updating-magisk-to-magisk-canary-version-to-fix-safetynet-issue-in-android-11
  2. https://www.thecustomdroid.com/fix-safetynet-hardware-attestation-guide/

Questions regarding this scenario:

  1. In case if root detection is bypassed, As database is encrypted there should be no chance to any app data leak. If root detection is bypassed, is encypted database is secure enlugh to prevent app from data leak ?

  2. Is there any currently known mitigations available to detect Magisk and Magisk hide on Android app?

  3. If There is new method to bypass and hide root then there is need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new library for root detection ?