isRooted Detection can be improved about aarogyasetu_android HOT 17 OPEN

What is the rationale for this? Since the app has been open-sourced, if someone wanted to run it on a rooted phone, they could simply edit the source to skip the root check and then build an APK of that and use it, right? As I commented on #26, whatever client-side checks are implemented in the app for stopping mock location, rooted use etc., a malicious actor could bypass them in their own build of the app and continue to remain malicious.

from aarogyasetu_android.

Yup i agree..the root detection used here is old-school 👍..

from aarogyasetu_android.

isRooted Only check the test-keys , uperuser.apk and su but system can be rooted with many other way.

Like
TEST KEYS
DEV KEYS
NON RELEASE KEYS
DANGEROUS PROPS
PERMISSIVE SELINUX
SU EXISTS
SUPERUSER APK
SU BINARY
BUSYBOX BINARY
XPOSED
RESETPROP(EXPERIMENTAL)
WRONG PATH PERMITION
HOOKS

these are some key points

https://github.com/DimaKoz/meat-grinder

This uses some some native NDK methods to check so..

I can push this mechanisam as I've implemented this in my another app

Thanks n Regards:
Haneet Singh Chhabra

I will suggest to raise a PR with proper comment. This will help developer to understand your concern in more efficient manner and as you have already implemented, you may know pros and cons in better way and able to provide solution more efficiently.

from aarogyasetu_android.

isRooted Only check the test-keys , uperuser.apk and su but system can be rooted with many other way.
Like
TEST KEYS
DEV KEYS
NON RELEASE KEYS
DANGEROUS PROPS
PERMISSIVE SELINUX
SU EXISTS
SUPERUSER APK
SU BINARY
BUSYBOX BINARY
XPOSED
RESETPROP(EXPERIMENTAL)
WRONG PATH PERMITION
HOOKS
these are some key points
https://github.com/DimaKoz/meat-grinder
This uses some some native NDK methods to check so..
I can push this mechanisam as I've implemented this in my another app
Thanks n Regards:
Haneet Singh Chhabra

I will suggest to raise a PR with proper comment. This will help developer to understand your concern in more efficient manner and as you have already implemented, you may know pros and cons in better way and able to provide solution more efficiently.

This feature will increase the app size and require NDK support so before pr I just want to make sure, they actually want it.

from aarogyasetu_android.

Root beer is another popular library that is utilised in other govt apps as well

from aarogyasetu_android.

Root beer is another popular library that is utilised in other govt apps as well

This looks pretty good, I guess..

from aarogyasetu_android.

Root beer is another popular library that is utilised in other govt apps as well

I just spoke to some people.. magisk bypass this lib..

from aarogyasetu_android.

now we are reviewing is 'https://github.com/DimaKoz/meat-grinder' 'magisk' safe or not

from aarogyasetu_android.

There is no perfect root detection library..even the one you mentioned above can be bypassed..I use Magisk + Xposed and can see it giving result as 'Non-rooted'

from aarogyasetu_android.

now we are reviewing is 'https://github.com/DimaKoz/meat-grinder' 'magisk' safe or not

Just Reviewing test came across..

meat-grinder is magisk safe..

we can use it

from aarogyasetu_android.

There is no perfect root detection library..even the one you mentioned above can be bypassed..I use Magisk + Xposed and can see it giving result as 'Non-rooted'

Okay

from aarogyasetu_android.

Related #26

from aarogyasetu_android.

What is the rationale for this? Since the app has been open-sourced, if someone wanted to run it on a rooted phone, they could simply edit the source to skip the root check and then build an APK of that and use it, right? As I commented on #26, whatever client-side checks are implemented in the app for stopping mock location, rooted use etc., a malicious actor could bypass them in their own build of the app and continue to remain malicious.

I Don't think so they're going to provide end links..

they may provide server side code which you need to implement in your environment..

but for usage of this app you need to download it from play store

from aarogyasetu_android.

you can make changes in these android or server code and raise a pull request. They may include it and push that to production..

from aarogyasetu_android.

It will not be useful , bypass root is very easy.

Just a wasting of time

The thing is safetynet with tee, anyway I don't know if anybody uses these apps.

from aarogyasetu_android.

It will not be useful , bypass root is very easy.

Just a wasting of time

The thing is safetynet with tee, anyway I don't know if anybody uses these apps.

Yeah.. You're right, someone will crack it..
but we still need to add as much as security as we can..

from aarogyasetu_android.

now we are reviewing is 'https://github.com/DimaKoz/meat-grinder' 'magisk' safe or not

Just Reviewing test came across..

meat-grinder is magisk safe..

we can use it

FYI
It's not magisk safe..

from aarogyasetu_android.