Skip to content

MASWE-0051: Root/Jailbreak Detection Not Implemented

MAS Requirement

The app detects if it runs on a rooted/jailbroken device and reacts appropriately.

Mappings

MASVS V1: MSTG-RESILIENCE-1, MSTG-RESILIENCE-8

MASVS V2: MASVS-RESILIENCE-1, MASVS-RESILIENCE-4

CWE: CWE-1326: Missing Immutable Root of Trust in Hardware

Overview

This weakness occurs when an app does not implement effective techniques to detect whether the device it runs on is rooted or jailbroken.

On a rooted or jailbroken device, the platform's sandboxing and permission guarantees no longer hold: privileged users and tools (e.g. Magisk, SuperSU, Xposed, or jailbreak toolchains and their managers) can access the app's private data, instrument its process, and defeat its client-side controls. More broadly, the app should apply Runtime Application Self-Protection (RASP) techniques that detect a compromised environment and trigger appropriate responses.

Modes of Introduction

  • No Detection Implemented: Shipping without any checks for rooting or jailbreak artifacts, such as management apps, su binaries, hooking frameworks, modified system properties, or writable system partitions.
  • Naive or Single-Point Checks: Implementing one easily located check whose removal or hooking disables the entire defense.
  • No Response Strategy: Detecting a compromised environment but not responding to it in a way appropriate to the app's risk profile.

Impact

  • Bypass of Protection Mechanisms: Attackers can use elevated privileges to defeat the app's client-side security controls, resulting in the circumvention of protections such as anti-tampering, licensing, or fraud controls.
  • Compromise of Sensitive Data: Attackers can read the app's private data and intercept its runtime state without sandbox restrictions, resulting in exposure of user data, keys, and tokens.

Mitigations

  • Implement Layered Detection: Combine multiple, varied checks (file-system artifacts, system properties, management apps, behavioral probes) implemented in different layers (e.g. native code) so no single patch disables them all.
  • Respond Appropriately: Define graded responses to detection, from warning the user to restricting sensitive functionality or terminating, matched to the app's risk profile.
  • Combine with Attestation: Back local checks with server-verified device attestation (see Device Attestation Not Implemented) so the backend can act on integrity signals even if local checks are bypassed.
  • Assess Effectiveness: Regularly test the detection against publicly available bypass tools and update it as evasion techniques evolve.

Knowledge

MASTG-KNOW-0084: Jailbreak Detection MASTG-KNOW-0027: Root Detection

Tests

MASTG-TEST-0240: Jailbreak Detection in Code MASTG-TEST-0241: Runtime Use of Jailbreak Detection Techniques MASTG-TEST-0325: Runtime Use of Root Detection Techniques MASTG-TEST-0324: References to Root Detection Mechanisms

Best Practices

MASTG-BEST-0029: Implementing Resilience and RASP Signals MASTG-BEST-0030: Implementing Root Detection