Root detection can be bypassed using Magisk hide: how to mitigate?

Question

I have recently been assigned a new security fix for my Android App. The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection implementation.

The description given by the VAPT team:

"Root detection is checked based on package name and availability of su binary."

What they did to bypass Root detection:

1. Set Magisk application package name to random.
2. Apply Magisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is a rooted device.

Root detection implementation on App:

1. We have "Root Bear" and "Root Tool" libraries integrated for Root detection on Android device.
2. All App data are stored in encrypted database on Android App.

I have also checked possible ways to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough.

I found links which say they are able to bypass Safety net detection also:

1. https://nooberinfo.com/magisk-hide-not-working-on-banking-apps-2021-magisk-hide-not-working-2021-android-11/#19-method-6-updating-magisk-to-magisk-canary-version-to-fix-safetynet-issue-in-android-11
2. https://www.thecustomdroid.com/fix-safetynet-hardware-attestation-guide/

Questions regarding this scenario:

1. In case if root detection is bypassed, as database is encrypted there should be no chance of any app data leak. If root detection is bypassed, is an encrypted database secure enough to prevent app from leaking data?

2. Is there any currently known mitigations available to detect Magisk and Magisk hide on Android app?

3. If there is a new method to bypass and hide root then there is a need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new libraries for root detection?

Answer 1

SafetyNet's hardware-backed attestation hasn't been defeated yet and the way it works, it is infeasible to defeat it by software. Universal SafetyNet Fix Magisk module downgrades evaluation type to BASIC which is software based evaluation that is defeated by Magisk.

All Google apps licensed android 8+ devices are provisioned with TEE so all of them support hardware-backed attestation. You don't have to implement your own detection techniques. Use SafetyNet API and check on your web service if evalType is hardware-backed in the attestation response. You can deny the service to the client if the android version is 8+ and evaluation type is basic.

You have to make exception for the lower android versions because those devices either may not have TEE or their TEE's public key is not certified by Google root certificate authority. Also make an exception for OnePlus7, despite android 8+, it's hardware backed attestation is broken so SafetyNet fallsback to basic evaluation type.

An app with root access can extract secrets of your app by using code injection, memory dump and impersonating your app. TEE cannot prevent compromise of the host OS.