I have recently been assigned a new security fix for my Android App. The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection implementation.
The description given by the VAPT team:
"Root detection is checked based on package name and availability of su binary."
What they did to bypass Root detection:
- Set Magisk application package name to random.
- Apply Magisk hide settings. It will hide su binary from Application. So, Application work as normal. The means Magisk Hide lets you use apps without letting it know that it is a rooted device.
Root detection implementation on App:
- We have "Root Bear" and "Root Tool" libraries integrated for Root detection on Android device.
- All App data are stored in encrypted database on Android App.
I have also checked possible ways to fix like SafetyNet’s Hardware Attestation but I found that it is also not enough.
I found links which say they are able to bypass Safety net detection also:
Questions regarding this scenario:
In case if root detection is bypassed, as database is encrypted there should be no chance of any app data leak. If root detection is bypassed, is an encrypted database secure enough to prevent app from leaking data?
Is there any currently known mitigations available to detect Magisk and Magisk hide on Android app?
If there is a new method to bypass and hide root then there is a need to integrate new Root detection library on Android App which in turn increases Android APK size each time. Is it always a good idea to integrate new libraries for root detection?