The root access on the Android operating system can pose
a security risk to applications as it allows the execution of
malicious software with elevated privileges. For this reason,
manufacturers incorporate mechanisms into their applications
to detect and prevent execution on devices with root privileges.
The paper presents four methods to bypass such protections,
including dynamic and static analysis and two configurations
of the Magisk modules. First, it demonstrates their use on a
test application, and then it analyzes a set of 23 Slovenian
applications to determine the frequency of the root detection,
the types of the implemented protection methods, and the effectiveness of the presented protection bypassing methods. The
root detection is present in ten of the analyzed applications,
where it is most often included in mobile banking applications.
In five cases, the protection bypass is successful with each
of the described methods, and in one case the protection is
bypassed only with a manual analysis. In the applications
that encrypt parts of their code, bypassing the protection is
unsuccessful, while in four of the five remaining cases, it is
trivial to prevent root detection
|
