Screen Recording Detection

Android devices are capable of recording their screen. Frequently a recorded screen is also shared elsewhere (similar to screen sharing). Screen recording can pose a security risk, as sensitive information might be leaking from app screens.

Since Android 15, Malwarelytics for Android is able to detect that the screen is being recorded and can be configured to terminate the app in such a case. Info about the detections is then delivered through the RaspObserver.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .screenRecording(DetectionConfig)
    // configuration of other RASP features
    .build()

Available values of DetectionConfig:

Screen recording detection defaults to DetectionConfig.Notify.

List of available parameters for some config values:

Usage

After initialization, the screen recording detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual screen recording detection check.

Registering an Observer

The screen recording detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    override fun onScreenRecordingDetected(screenRecordingDetection: ScreenRecordingDetection) {
        // handle screen recording detection
        // delivered only on Android 15+
    }
    // handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The ScreenRecordingDetection data class contains the following properties:

Available values of ScreenRecordingVisibilityStatus:

Triggering a Manual Check

The screen recording detection check can be triggered manually in RaspManager. Two methods are available – isScreenBeingRecorded() gives a simple boolean answer, whereas getScreenRecordingDetection() provides more details.

val screenRecordingDetection: ScreenRecordingDetection = raspManager.getScreenRecordingDetection()
val isScreenBeingRecorded: Boolean = raspManager.isScreenBeingRecorded()

Details about Returned Data

Data reported via RaspObserver are related to the current changes to screen recording and navigation between the app’s activities. That means every activity becoming visible in a screen recording is reported. On the other hand, when the app stops being visible in a screen recording, it’s reported only for the last activity that was visible in the reporting.

Manual check returns the latest data that were previously reported via RaspObserver. This means:

• When the app is being recorded, the data will report the current foreground activity being recorded.
• When the user leaves the app and another app comes to the foreground, the data will report that the last activity stopped being recorded.
• When the recording stops while the app is in the foreground, the current foreground activity is reported as stopped being recorded.
• When no screen recording has ever happened, the data reports the NO_DATA value and no activity class name.