Configuration

The minimum configuration for the Malwarelytics is setting up the username, password, and the public key in the malwarelytics.xml (for each platform Android/iOS). However, we recommend configuring all features that are present in the SDK.

The Username, Password and Signature Public Key can be obtained in the Malwarelytics console. Note that these credentials are bound to your application Package Name/Bundle ID. If you need to support multiple environments (Package names/Bundle IDs), you need different credentials for each environment.

Configuring the Service

To enable Malwarelytics in your Cordova app, you need to call the initialize method with the following configuration object. All properties are optional.

// Note that all the folowing configurations are optional, you can pass empty object {} and it will work.
// It is recommended to  set your client id though to identify the user.
await window.plugins.malwarelytics.initialize({
    clientId: "your-client-id", // To identify the user. Can be changed later.
    deviceId: "your-client-id", // To identify the users phone. Can be changed later.

    // Configuration for the Android platform
    androidConfig: {
        languageCode: "en", // Language of the UI (for smart protection)
        antivirus: { // Configuration of the antivirus component
            enableSilentMode: false, // Silent mode enabled = no UI
            onlineCheckIntervalHours: 48, // check for update every 48 hours
            updateOnInitialize: true // the virus database will be updated on the startup
        },
        rasp: { // configiration of the Runtime Application Self Protection
            checkEmulator: true, // to enable observer reports
            exitOnEmulator: true, // do not exit when on emulator
            checkRoot: true, // to enable observer reports
            exitOnRoot: true, // do not exit when the device is rooted
            exitOnRootMinConfidence: 1, // exit only when we're sure
            checkHttpProxy: true, // to be notified when http proxy is enabled
            exitOnHttpProxy: false, // disable exit on http proxy
            checkDebugger: true, // to enable observer reports
            exitOnDebugger: true, // exit when debugger is connected
            checkRepackaging: true, // to enable observer reports
            exitOnRepackaging: true, // exit when the app is repackaged
            signatureHash: "....", // hash of the apps signature
            checkScreenSharing: true, // to enable observer reports
            exitOnScreenSharing: false, // do not exit the app when screen sharing is on
            blockScreenshots: true, // block screenshots
            blockScreenReaders: true, // disable screen readers
            allowedScreenReaders: [], // list of alowed screen readers
            customProcessName: null, // can set custom process name
            useStealthyProcessName: true, // use random process name
            blockTapjacking: true, // block tapjacking
            blockTapjackingSensitivity: "HIGHLY_DANGEROUS" // block tapjacking for highly dangerous and malware apps
        },
        customerGrouping: {
            // customer grouping is advanced technique that is described in separated documentation topic
            sourcePackageName: null,
            appPackageName: null,
            audienceGroupId: null
        }
    },

    // Configuration for the Apple platform
    appleConfig: {
        rasp: { // configiration of the Runtime Application Self Protection
            // when the device is jalibreaked, exit and show url
            jailbreak: { action: "EXIT", exitUrl: "https://wultra.com?exit=jalibreak" },
            // when debugger is connected, exit and show url
            debugger: { action: "EXIT", exitUrl: "https://wultra.com?exit=debugger" },
            // when reverse engineering tools are present, notify via the observer
            reverseEngineeringTools: { action: "NOTIFY" },
            // when HTTP proxy is on, notify via the observer
            httpProxy: { action: "NOTIFY" },
            // when the app is repackaged, exit and show url
            repackage: { action: "EXIT", exitUrl: "https://wultra.com?exit=repackaged", base64EncodedTrustedCertificates: ["BASE64encodedcert"]},
            // when screen is being captured, notify via the observer
            screenCapture: { action: "NOTIFY" }
        },
        events: {
            enableEventCollection: true, // enable event collection (like app turned on/off)
            enableScreenshotTakenCollection: true // enable screenshot event collection
        },
        customerGrouping: {
            // customer grouping is advanced technique that is described in separated documentation topic
            sourceBundleId: null,
            appBundleId: null,
            audienceGroupId: null
        }
    }
});

Customer Grouping and Naming

The SDK allows passing custom values that are used to group data in the Malwarelytics web console application.
The configuration items in MalwarelyticsConfig.android.customerGrouping and MalwarelyticsConfig.android.customerGrouping add extra metadata that is passed into the web console.
The data allow to split data into groups and obtain different views on the data.

Limitations for the strings are following:

  • Max length of the sourceBundleId/sourcePackageName is 255 characters
  • Max length of the appBundleId/appPackageName is 255 characters
  • Max length of the audienceGroupId/audienceGroupId is 20 characters

The main grouping of the data is achieved with sourceBundleId/sourcePackageName. The value has to agree with the application credentials in the web console.
The extra granularity of data views is achieved with appBundleId/appPackageName.
The last option audienceGroupId is used to distinguish users from different customer systems such as “RETAIL”, “CORPORATE” and so on.

Last updated on Apr 25, 2022 (12:09) Edit on Github Send Feedback
Search

4.0.x

Malwarelytics for Cordova