Detection of HTTP Proxy

A system-wide HTTP proxy configuration can force all HTTP (and, in some cases, HTTPS) requests from your app to pass through a proxy server. This is a potentially harmful behavior since the proxy server can then inspect or even modify request payloads. Furthermore, Android allows configuring an HTTP proxy without the user being fully aware of this fact.

Malwarelytics for Android is able to detect that an HTTP proxy is being used and can be configured to terminate the app in this case.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .httpProxy(DetectionConfig)
    // configuration of other RASP features
    .build()

Available values of DetectionConfig:

Value Description
NoAction indicates that the HTTP proxy will not be automatically detected. A manual check is still possible.
Notify indicates that the HTTP proxy will be automatically detected and observers will be notified.
Exit(
exitUrl:String?)
indicates that the HTTP proxy will be automatically detected and the app will be terminated when an HTTP proxy is automatically detected.

HTTP proxy detection defaults to DetectionConfig.Notify.

List of available parameters for some config values:

Parameter Description
exitUrl:String? defines the URL to be opened when the app is terminated because of the automatic detection. Defaults to null.

Usage

After initialization, the HTTP proxy detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual HTTP proxy detection check.

Registering an Observer

HTTP proxy detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    override fun onHttpProxyDetected(httpProxyDetected: Boolean) {
        // handle HTTP proxy detection
    }
    // handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

Triggering a Manual Check

HTTP proxy detection check can be triggered manually in RaspManager. Two methods are available - isHttpProxyEnabled() gives a simple boolean answer, whereas getHttpProxyDetection() provides more details.

val isHttpProxyEnabled = raspManager.isHttpProxyEnabled()
val httpProxyDetection = raspManager.getHttpProxyDetection()

More information on general RASP feature configuration and usage can be found in this overview.

Last updated on Nov 21, 2023 (13:06) View product
Search

develop

Malwarelytics for Android