Runtime Tampering Detection

Runtime tampering (also called dynamic instrumentation) refers to techniques that allow an attacker to inspect and modify the behavior of a running app without altering its binary. Various tools and hooking frameworks can attach to a live process and intercept or replace method calls, read memory, or alter application logic at runtime. Detecting these tools is a key RASP feature because their presence in a production environment is a strong indicator of a reverse engineering or active attack attempt.

Malwarelytics for Android is able to detect the presence of several runtime tampering technologies and can be configured to terminate the app when such a technology is detected.

Configuration

This feature can be configured during the Malwarelytics initialization phase:

val raspConfig = RaspConfig.Builder()
    .runtimeTampering(DetectionConfig)
    // configuration of other RASP features
    .build()

Available values of DetectionConfig:

Runtime tampering detection defaults to DetectionConfig.Notify.

List of available parameters for some config values:

Usage

After initialization, the runtime tampering detection feature can be accessed via RaspManager. This can be used to register an observer or to trigger a manual check.

Registering an Observer

Runtime tampering detection can trigger a certain action. To achieve that, an observer needs to be configured and registered.

Observer configuration:

val raspObserver = object : RaspObserver {
    // The callback is delivered on a background thread
    override fun onRuntimeTamperingDetected(runtimeTamperingDetection: RuntimeTamperingDetection) {
        // Handle runtime tampering detection
    }
    // Handle detection of other RASP features
}

The observer can be registered in RaspManager. When it is no longer needed, it can be unregistered again.

raspManager.registerRaspObserver(raspObserver)
raspManager.unregisterRaspObserver(raspObserver)

The RuntimeTamperingDetection data class contains the following properties:

Triggering a Manual Check

Runtime tampering detection can be triggered manually in RaspManager. Two methods are available – isRuntimeTamperingPresent() gives a simple boolean answer, whereas getRuntimeTamperingDetection() provides more details.

// Always run on a background thread
val runtimeTamperingDetection: RuntimeTamperingDetection = raspManager.getRuntimeTamperingDetection()
// Always run on a background thread
val isRuntimeTamperingPresent: Boolean = raspManager.isRuntimeTamperingPresent()