Android Security: Adding Tampering Detection to Your App

The current issue of security breaches and safety alerts has diverted everyone’s attention and enhanced the importance of security. It has become a necessity rather than a should-have requisition in mobile app development. Android faces a lot of negative media attention because of its open nature and the convenience it offers to the users to download APK files from known and unknown resources.

Whether you have chosen a genuine substitute to Google’s Play Store like Amazon App Store or a suspicious forum post, a centralized controlling app store appeals to user choice. But, it has its risks, especially if the apps are installed from places that don’t have Android security.

Android apps are compacted, packed, and distributed in the form of .apk files, the same as .jar and .zip files. They have all the compiled sources (coding, images, database, layout, etc.) needed for the app. However, the format isn’t secure at all. APKs can be easily extracted through archive software, and the source code can be decompressed easily with free tools and then reverse-engineered. It is an important way through which hackers can tamper with your app.

However, there are ways to prevent your app from getting pirated. Though there isn’t 100% security, the Android security techniques can prevent attacks.

Verifying your app’s signing certificate

App developers should go for a code signing certificate before publishing the app. The code signing certificate should be consistent throughout the app’s life.

Today, the android market engages over 85% of the smartphone realm, making it a juicy target for hackers. Android application teamed with a code signing certificate helps developers offer a secure application to the users.

The certificate functions like an SSL certificate and changes your app code into an impenetrable format. The EV Code signing certificate is developed on the advantages of the standard code signing certificate to yield better assurance that the app is verified and secure. So, it gives customers more confidence. The higher scrutiny rules out the risk of the app getting hacked or tampered with.

The app signature will break in case the .apk is amended in any way. The technique ensures that the app has been signed with a certificate and is safe to download and install.

• Verify the installer

Every app has the identifier of the app that installed it. Hence, you can find it out through a simple inspection. First, verify the installer ID of the app.

• Environment checks

Another two checks to evaluate the environment the app is working in. Outside development, it is doubtful that the app should be running on an emulator. Launching applications with debuggable selected is not suggested as it lets connected computers debug the app through Android Debug Bridge.

• Emulator

If the app runs on an emulator outside the development, it suggests that someone else is trading to assess the app.

The emulator checks detect discreet system properties indicating the presence of an emulator. You can use ROMs and rooted devices to get modified values. For example, check if the ro.hardware has goldfish or not. It is commonly used on emulators.

• Debuggable

Letting apps get debugged when installed on an Android gadget is only allowed during the development process. Hence, debugging is done on a live build of your app, and it suggests that someone else is making efforts to analyze the app.

It is possibly the initial step that attackers do to decompile the app, allow debuggable flag, and recompile, letting them attach the debugger to find out how the app works.

Apart from this, there are Android Security check methods to help you:

• Proguard

It turns your code into an unreadable format, making it tough to understand; it is simple to add to the app. It also offers code shrinking functionality and wipes out unused resources. The only way to find out if anything is altered or not is by reverse-engineering the APK.

• Dexguard

Made by the team of Proguard, it is not available for it. However, it includes all that Proguard has additional features, such as String and Resource Encryption.

• Android NDK

Codes written in C or C++ deter hackers from reverse engineering your application. However, you do have side effects of using NDK, like performance problems and the introduction of bugs down the line.

• Piracy Checker

A known Github library with some fundamental methods to alleviate reverse engineering! There are multiple checks to run along with implementing Google Play Licensing Check.

• Google’s SafetyNet Attestation API

It is a great alternative. You get in touch with Google’s Attestation API, and they will run if the device the app is installed on is safe or not.

•  Deguard

You can upload an APK file on the website. It will make use of algorithms to reverse what’s done by Proguard. You can find out what all has changed along with the mod version of the app.

•  MobSF

MobSF works on Mac, Windows, and Linux. All you need to do is upload an APK, and all the risks will be detected. It does a fundamental analysis and showcases all the details about the APK, such as who signed the certificate, strings, app permissions, etc.

•  SafetyNet

It is a Google tool to help app developers detect tampering actions and take steps to safeguard from them. For example, it helps to detect users with a rooted device that tries to interrupt or alter sensitive data in the app.

•  Nonce

Nonce means a unique number that shouldn’t be copied. Generate it on your server in a secure way to prevent replication requests using the same nonce. According to the recommendation of Google, you should get part of the nonce from the data you are sending to your server.

Wrapping up

To prevent your app from getting tampered with, you have found all the methods needed. However, there is a quick and simple way to confirm the app install, and the most important one is how to find out if your app is still signed with the developer’s signature.

But, what should you do when you detect an app tampering? It is subjective and differs from one app to another; users report the situation to a server so that the scale of the issue can be assessed.

Previously, Flurry or Crashlytics used to display messages like “the app has been tampered with” alerts and details on how to get in touch with the developers. The steps taken included wiping the user’s data or disabling the chosen functionality. Eventually, it is all about how someone decides to handle it.

As mentioned before, reverse engineering and decompiling an app is simple. So, how do you stop a hacker from removing the tampering measures?

Well, you don’t need to do anything. You can conjunct them with code obfuscation, with prevention tools like ProGuard. You can also use a tool that actively helps to protect compiled code like DexGuard.

Using the above methods will help you add additional Android security to your apps and help with tampering detection. So, use the one that suits you and if you want to discuss more Android security, feel free to contact us!