Spoofed Location Detection

Android devices provide a way to spoof (mock) location for development purposes. Unfortunately, mocked locations are often misused to mask fraudulent activities. For this reason, it’s vital for a financial app to detect whether the obtained location is genuine.

Android supports mock location functionality via configuring a “mock location application” in the developer settings.

Malwarelytics for Android is able to check whether an obtained location was mocked and to detect whether an application capable of mocking location is present on the device.

Configuration

There’s no configuration for the feature.

Usage

After initialization, the spoofed location detection feature can be accessed via RaspManager. This can be used to perform manual checks.

Triggering a Manual Check

Spoofed location detection consists of two separate manual checks:

1. Checking if a Location object was mocked.
2. Listing installed apps capable of mocking locations.

Checking If Location Was Mocked

A location object can be checked whether it was mocked by calling the isLocationMocked(Location): Boolean method.

val isMocked = raspManager.isLocationMocked(location)

Listing Installed Apps Capable of Mocking Locations

If the application uses android.permission.QUERY_ALL_PACKAGES permission. The SDK can list all applications that are capable of mocking the location.

In case the application doesn’t use the QUERY_ALL_PACKAGES permission, the feature becomes ineffective and always returns an empty list of apps.

The list of apps capable of mocking location can be triggered manually in RaspManager by calling the getSpoofedLocationDetection() method. A data class containing the list of apps identified by their package names is returned.

val spoofedLocationDetection: SpoofedLocationDetection = raspManager.getSpoofedLocationDetection()
val mockLocationApps: List<String> = spoofedLocationDetection.mockLocationApps