Repackaging Detection

Repackaging detection is a security feature that detects that the application was modified and signed again with a different signing certificate or by a different team. In-App Protection Shielder for Apple is able to detect that the application has been repackaged and can be configured to terminate the application in that case.

Configuration

expected_team_id: "ABCDE12345"
trusted_certificate_sha256:
  - "<SHA-256 of a signing certificate>"

rasp:
  repackaging:
    enabled: true
    response:
      action: terminate

Repackaging detection is enabled by default and defaults to terminate. The available responses are described in RASP Feature Overview.

Team ID

expected_team_id is the Apple Team ID the application is signed with. It is optional when the Shielder signs the application and, if set, must match the selected provisioning profiles. With deferred signing, expected_team_id is required for repackaging detection, and the final signature must use this Team ID.

The Team ID of a signed application can be read with:

codesign -dv App.app 2>&1 | grep TeamIdentifier

Trusted Certificates

trusted_certificate_sha256 lists the certificates the application is signed with outside the App Store and TestFlight, for example a Development certificate for development builds or a Distribution certificate for Ad Hoc and Enterprise builds. Builds signed by Apple for the App Store and TestFlight do not need to be listed.

The hash of a certificate can be computed from the keychain:

security find-certificate -c "Apple Development: Jane Doe" -Z | grep SHA-256

Or from a .cer file exported from Keychain Access:

shasum -a 256 certificate.cer

When the Shielder signs the application with an identity given by its SHA-1 hash and the list is not empty, the signing certificate is added to the list automatically.

Read Next

• Binary Integrity Verification