Camera Stream Tampering Detection

Camera stream tampering refers to techniques that inject fabricated (fake) video into an app’s camera stream, for example via virtual/fake camera apps, video injection tools, or AI-based face-swap and image/video editing tools. Attackers use these techniques to bypass identity verification or liveness detection flows that rely on the device camera. Detecting the presence of such tools is a key RASP feature because it is a strong indicator of an ongoing attempt to defeat camera-based verification.

Malwarelytics for Android is able to detect the presence of several categories of camera stream tampering tools and can be configured to terminate the app when such a tool is detected.

The feature is heuristic and operates with a confidence value. It’s recommended to always evaluate the confidence value before using the returned data. The confidence indicates the reliability of the result.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .cameraStreamTampering(ConfidenceAwareDetectionConfig)
    // configuration of other RASP features
    .build()

Available values of ConfidenceAwareDetectionConfig:

Camera stream tampering detection defaults to ConfidenceAwareDetectionConfig.Notify.

List of available parameters for some config values:

Usage

After initialization, the camera stream tampering detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual check.

Registering an Observer

Camera stream tampering detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    // The callback is delivered on a background thread
    override fun onCameraStreamTamperingDetected(cameraStreamTamperingDetection: CameraStreamTamperingDetection) {
        // Handle camera stream tampering detection
    }
    // Handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The CameraStreamTamperingDetection data class contains the following properties:

Triggering a Manual Check

Camera stream tampering detection can be triggered manually in RaspManager. Two methods are available – isCameraStreamTamperingPresent() gives a simple boolean answer, whereas getCameraStreamTamperingDetection() provides more details.

// Always run on a background thread
val cameraStreamTamperingDetection: CameraStreamTamperingDetection = raspManager.getCameraStreamTamperingDetection()
// Always run on a background thread
val isCameraStreamTamperingPresent: Boolean = raspManager.isCameraStreamTamperingPresent()