Our team is trying to secure a native Android mobile app.
Amongst other things we are using Dexguard for some checks such as tamper, root and emulator detection.
Long story short: some of these checks fail in our debug builds - mainly because we want to keep the build times short for developers - and we need some way to skip them [1].
The suggestion by official Dexguard support was to use something like this:
if(!BuildConfig.DEBUG){
// do actual check if app has been tampered with
}
Now I'm worrying:
Doesn't such a conditional make the tampering checks very easy to circumvent for an attacker?
My fear is that if an attacker tries to tamper with the app, he can easily do so if he is also able to somehow make it think that it is a DEBUG build. Thus with little effort all the (expensive) Dexguard tamper checks are circumvented...
Are my concerns justified? Does including a conditional such as above make tampering the app easier for attackers?
[1]: The background here is: Dexguard makes builds take a looong time. Such as 50 seconds instead of 5 seconds for a simple unit test re-run. Because of this we disable Dexguard for our debug build, which in turn makes certain of the checks (such as tamper detection) fail, as they rely on the APK being processed by Dexguard.
