When it comes to securing your mobile app, one of the main challenges you'll face is the wide range of mobile devices it will be installed on.
After all, while you can control the security protections in your own digital products, you have very limited visibility over the smartphones of those who’ll be using them. All the pen testing, debugging, and QA analysis in the world can’t guarantee your app will make its way onto an up-to-date and uncompromised device.
One of the biggest examples of this issue is rooting and jailbreaking. With a standard iOS or Android device, you can rely on several out-of-the-box defenses designed to protect apps, data, and users. But when smartphones are rooted or jailbroken, these defenses become weaker, and sometimes entirely redundant.
This is why app developers want to protect the integrity of their apps by detecting rooted or jailbroken devices. But that’s more difficult than it seems.
So how can you get it right? What are the most effective root/jailbreak detection tools today? And what’s the best approach for developers like you looking to protect their valuable intellectual property?
In this article, we explain everything you need to know about root/jailbreak detection for mobile apps.
Rooting or jailbreaking removes built-in restrictions on mobile devices, giving the end user admin-level permissions to make changes to their device. Rooting occurs on Android devices, and jailbreaking on iOS.
But rooting and jailbreaking aren’t new. Mobile users have been using these techniques to remove smartphone controls for as long as manufacturers have been implementing them. As new rooting/jailbreaking techniques emerge, identifying such devices only grows more difficult.
Read more: Root detection: What it is and how it works
Sometimes, rooting or jailbreaking is done directly by malicious actors. But usually, the mobile device owners perform it. There are many reasons they might do it:
Whatever the reason for rooting/jailbreaking, such devices come with their own challenges, particularly organizations whose apps are downloaded and run on them. These include:
In short, app manufacturers have reasons to be wary of rooted/jailbroken devices, especially for apps involving sensitive personal data that needs to be protected, like financial services apps.
The good news is there are several techniques and tools that can help you detect rooted/jailbroken devices. But the bad news is: it isn’t as simple as it may first appear.
Rooting and jailbreaking might not be new—but neither are attempts to detect them. Over the years, this has created a cat-and-mouse game between those attempting to unlock their devices and the tools designed to detect this. In this section, we discuss some of the most common methods, considering the pros and cons of root detection and jailbreaking, and what other options are available.
Today, there are several common techniques. The app includes these features in its code, which activate on a user’s device when the app is installed. While these techniques aren’t perfect, they create an effective first layer of defense that can reduce your app’s exposure to rooted/jailbroken devices.
Here are some of the most common jailbreaking/ root detection methods:
When your app discovers evidence of rooting/jailbreaking, there are several options for how you can proceed:
Generally, root/jailbreak detection tools allow app manufacturers to customize these responses so you can choose what the best response is for your app and data.
Some of the techniques we described in this chapter are easier to bypass than others. When rooting/jailbreaking is performed through pre-packaged apps by non-technical users, root detection can be quite effective. But as we’ll discover, this isn’t always the case.
Read more: Mobile app security basics: Understanding hooking frameworks
“No root/jailbreak detection is perfect. They just add a useful hurdle for malicious actors to navigate. But there will always be ways to get around them. That’s why you shouldn’t base all your security on rooting detection. You need to add other protections in your app.”
While many jailbreak/root detection strategies have emerged over the years, hackers have developed innovative ways to get around them. This cat-and-mouse game means many of the root/jailbreak detection techniques we used to rely on simply aren’t effective anymore.
The methods we discussed in the last section are still commonly used in today’s rooting/jailbreaking tools. But they aren’t foolproof:
Taken together, these challenges mean that no jailbreak/root detection tools can be 100% effective.
So, app manufacturers have a key challenge to deal with: how do you protect your sensitive data and intellectual property from the risks of rooted/jailbroken devices?
At Promon, we take a different approach. Our view is that it’s safer to assume devices are rooted or jailbroken, and work backwards from there.
Effectively, this means defending against the vulnerabilities and challenges that rooting/jailbreaking creates, as well as trying to avoid it in the first place.
After all, rooted/jailbroken devices aren’t inherently more dangerous—they just lay the groundwork for several other potential attacks and vulnerabilities. If we can protect against these more fundamental issues, rooting/jailbreaking detection stops being an absolute necessity and becomes a “nice-to-have.”
“When it comes to app security, we need to think of it in layers. The first layer is rooting/jailbreak detection, which can identify devices rooted through the common methods.
End users can get around these hurdles but they have to put some effort in and know what they’re doing. That’s why we need to include other defenses like integrity checks, code obfuscation, and more.”
The best approach to app security is a layered one, and root/jailbreak detection techniques can play a valuable role in this strategy, including the techniques we discussed. This is particularly important in regions where root/jailbreak detection is a regulatory requirement.
But even when you have to include detection tools, you shouldn’t stop there. If you want to protect against the issues that rooted/jailbroken devices can create, you need to tackle the more fundamental issues that rooting/jailbreaking can lead to.
This is the approach we take at Promon. We include rooting/jailbreaking detection tools as a standard in our portfolio of app security products. But we also combine this with other tools and techniques:
These tools help prevent malicious activity like runtime analysis, malware injection, and more, which hackers use to reverse engineer the app logic or alter its behavior during runtime. These protections are a vital part of keeping your app safe:
A hacker may also try to perform “on-disk” analysis instead of or in combination with runtime analysis. This can include finding hard-coded tokens, passwords, or keys, as well as identifying vulnerabilities, stealing intellectual property, or other information designed to help plan a runtime-based attack.
Static protections aim to make it as difficult as possible to perform this analysis. These include:
Taken together, these techniques create a multi-pronged defense strategy that protects your app from both static and runtime-based attack strategies.
Read more: Obfuscation explained: A comprehensive guide to code protection techniques
Root and jailbreak detection remains a relevant, yet imperfect, aspect of mobile app security. The evolving landscape of rooting/jailbreaking, coupled with increasingly restricted app permissions, necessitates a more comprehensive, layered security strategy. By shifting the focus towards mitigating the underlying risks associated with rooted/jailbroken devices—such as code injection, reverse engineering, and data breaches—you can build more resilient applications.
Ultimately, a combination of proactive detection and robust preventative measures offers the most effective approach to safeguarding sensitive data and intellectual property in an increasingly complex mobile environment.