Runtime Tampering Detection

Runtime tampering (also called dynamic instrumentation) refers to techniques that allow an attacker to inspect and modify the behavior of a running app without altering its binary. Various tools and hooking frameworks can attach to a live process and intercept or replace method calls, read memory, or alter application logic at runtime. Detecting these tools is a key RASP feature because their presence in a production environment is a strong indicator of a reverse engineering or active attack attempt.

In-App Protection SDK for Android is able to detect the presence of several runtime tampering technologies and can be configured to terminate the app when such a technology is detected.

The feature is heuristic and operates with a confidence value. It’s recommended to always evaluate the confidence value before using the returned data. The confidence indicates the reliability of the result.

Configuration

This feature can be configured during the In-App Protection SDK initialization phase:

val raspConfig = RaspConfig.Builder()
    .runtimeTampering(ConfidenceAwareDetectionConfig)
    // configuration of other RASP features
    .build()

Available values of ConfidenceAwareDetectionConfig:

Runtime tampering detection defaults to ConfidenceAwareDetectionConfig.Notify.

List of available parameters for some config values:

Usage

After initialization, the runtime tampering detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual check.

Registering an Observer

Runtime tampering detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    // The callback is delivered on a background thread
    override fun onRuntimeTamperingDetected(runtimeTamperingDetection: RuntimeTamperingDetection) {
        // Handle runtime tampering detection
    }
    // Handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The RuntimeTamperingDetection data class contains the following properties:

Triggering a Manual Check

Runtime tampering detection can be triggered manually in RaspManager. Two methods are available – isRuntimeTamperingPresent() gives a simple boolean answer, whereas getRuntimeTamperingDetection() provides more details.

// Always run on a background thread
val runtimeTamperingDetection: RuntimeTamperingDetection = raspManager.getRuntimeTamperingDetection()
// Always run on a background thread
val isRuntimeTamperingPresent: Boolean = raspManager.isRuntimeTamperingPresent()