With data privacy regulations making root detection less effective, it’s time to find out how it really works and where it fits in your app security.
Rooting and jailbreaking come up in a lot of our conversations. When they do, the conversation generally looks a little bit like this:
“We’re worried about the security implications of running our apps on rooted devices, so root detection is an absolute must.”
Rooted or jailbroken devices certainly pose a security threat—and app vendors are right to be wary of the risks—but we don’t necessarily classify root detection as a “must-have.”
Of course, we’ll explain why. But first, let’s recap what rooting is, why it’s dangerous, and how root detection techniques try to defend against it.
Rooting or jailbreaking describes the process of unlocking a smartphone to gain elevated privileges. Generally, ‘rooting’ is done to an Android device and ‘jailbreaking’ to iOS. In both cases, the end user gets unrestricted rights over the device and the apps and information stored on it.
There is a whole range of commonly available tools that allow users to root or jailbreak their smartphones. This makes the process relatively straightforward for even non-technical users to perform.
Rooting and jailbreaking occur for a diverse range of different reasons. You might, for instance, want to remove bloatware or amuse yourself by changing the default font to Comic Sans. If you’re a developer or security researcher, you may also require root access to customize the operating system, access restricted apps and APIs, and perform security research.
Needless to say, some of these reasons are better than others…
“As an end user, rooting allows you to target your own device and the apps on it, to break the defenses that have been built in. You then have the privileges to analyze entry points that can be used to break those apps on other devices.
It also means malware and other tools have more power on rooted devices. This means they can do more damage than they would if downloaded via the Play Store onto a non-rooted device.”
- Morten Ruud, Product Manager at Promon
Whether the goal is superficial or sensible, rooting (or jailbreaking) creates a whole range of security risks.
But it’s not just about smartphone users. There are also several risks to organizations whose apps are downloaded onto jailbroken devices. These include:
Put simply, the risks of jailbroken devices are high. If you want to protect the security, intellectual property, and business model of your app, you’ll need to find a robust solution to keep your app safe.
But that’s easier said than done…
“Root detection tools have to manage with the limited information that apps have access to on the rest of the device. Nonetheless, there are certain common traces we can look out for. This includes basic checks for su executables and more advanced detection mechanisms that might be used to hide traces of rooting.
But root detection isn’t a guarantee, since modern tools can hide evidence of rooting/jailbreaking. For this reason, it has to be used in combination with other app protection techniques.”
- Morten Ruud, Product Manager at Promon
Rooting/jailbreaking is not a new phenomenon. End users have been finding their way around smartphone restrictions for just about as long as manufacturers have been implementing them.
Over the years, this has created something of a cat-and-mouse game between those trying to simplify jailbreaking and those trying to protect their apps. But app vendors haven’t been sitting on their hands. With the risk being so high, several common root detection methods have evolved over the years to help defend against it.
There are both pros and cons of root detection tools, and they’re far from foolproof. But they can provide an important first line of defense, so it’s important to be aware of the options.
Generally, root detection tools scan the device that the app has been installed on, aiming to identify telltale signs of rooting/jailbroking. These include:
Root detection tools use a combination of these methods because no single approach is foolproof. The products themselves can generally be built into apps, so the defenses kick into gear when they’re installed on smartphone devices.
App vendors generally have several customizable options for how they respond to rooted devices, including programmatic blocking (reducing access to certain features) or terminating the app entirely.
The cat-and-mouse nature of root detection means it’s impossible to be 100% sure whether or not a device is rooted. There are several important reasons for this:
Most of the root detection approaches we discussed above rely on the app detecting suspicious risk signals on the end users’ devices. This is increasingly difficult to do over time because restricting apps’ ability to do this is a fundamental feature of data privacy.
In the post-GDPR world, privacy restrictions increasingly restrict the amount and type of data that apps can access on a user’s device without their consent. Because the regulations are becoming more stringent by the day, root detection is likely to get less effective over time—not more.
To keep our apps safe, we therefore need a fundamentally different approach.
Root detection is certainly a valuable tool and an important part of your app’s security posture. But at Promon, our view is that it’s best thought of as a filter rather than a barrier. Since it can’t reliably protect against the risk of rooted or jailbroken devices, we have to combine it with more fundamental security tools.
So how do we do this? Our approach is to always assume that devices are rooted or jailbroken—and then protect them from the risks. This is why we say that root detection technology is a nice-to-have.
There are a number of additional protections we use to substantially reduce the risk of running your app on an insecure device:
While root detection adds a valuable layer of security, you cannot rely on it alone. To deal with complex risks, you need a robust strategy that goes beyond detection by integrating advanced measures to build resilience against threats, even on compromised devices. A multi-layered approach that treats root detection as one piece of a comprehensive security puzzle is essential to protect your apps and data.