How to effectively detect a rooted device on Android?

Question

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet https://www.joeyconway.com/blog/2014/03/29/android-detect-root-access-from-inside-an-app/.

The problem is that it is not that difficult to bypass such verifications. One of the many ways to do so is to get a temporary root shell for executing any commands we want. As an example, Towelroot embeds a kernel root exploit for getting local root privileges. This enables him to permanently root the device by installing the necessary binaries. The same way, one can use the same technique but just for returning a temporary root shell instead of permanently rooting the device. This way no additional files will be installed, static checks will fail.

How is it possible to detect such kind of scenario?

Answer 1

There is Safety Net Attestation API of Google play services by which we can assess the device and determine if it is rooted/tampered.

Please go through my answer to deal with rooted devices: https://stackoverflow.com/a/58304556/3908895

Answer 2

There is no general answer to this questions as this completely depends on the type of the rooting procedure used. This paper (WOOT workshop of USENIX security 2015) gives a nice overview of the different kinds of rooting procedures.

So if you want to implement a root checker, your chances are best if you can detect the majority of popular root methods.

Answer 3

SafetyNet Attestation API can do the work for you. It helps you assess the security and compatibility of the Android environments in which your apps run. You can use this API to analyze devices that have installed your app.

Answer 4

There is another reliable way to check whether the Android Phone is rooted or not. For that, you need to download Android Debug Bridge (ADB). After that, you have to open "cmd" and open the path of ADB in same. Now, you have to run following commands:

1. adb devices : This command will list the attached Android devices.
2. shell serial_number: This command will open shell/terminal for a particular android device.
3. su : This command is to get super-user access of any terminal. Now, after running this command if you get an error "Permission Denied" than your device is not rooted and if you do not get any error than your device is rooted.

Reference:

1. Android Debug Bridge download
2. ADB commands

Answer 5

You are right, it is impossible to reliably detect root, especially from a sandboxed app. A rootkit can (i.e. it is not technically impossible) run your app in a specially crafted VM, so that it sees an unmodified unrooted system.

On the other hand, such kits have not yet been detected. And building such would require a very serious effort and investment. I believe that such effort would be not be much different from STUXNET. Also note that if such rootkit is developed not in a top-security government-controlled manner, its "betas" would most likely be traced.

The forensic means of detection of any tampering (including rooting) may be much stronger than what is theoretically available to a (well-behaved) user-space application, but even they are not unlimited.

Breaching security and detecting such breaches is an infinite game, and any ideas we could come up with to detect root, can find an answer by the perpetrators of such attacks, if their motivation is high enough.

But most likely, they don't care about your specific app or your personal device, so you can simply include basic test for presence of su and known superuser apps and ROMs.