When it comes to securing your mobile app, one of the main challenges you'll face is the wide range of mobile devices it will be installed on.
After all, while you can control the security protections in your own digital products, you have very limited visibility over the smartphones of those who’ll be using them. All the pen testing, debugging, and QA analysis in the world can’t guarantee your app will make its way onto an up-to-date and uncompromised device.
One of the biggest examples of this issue is rooting and jailbreaking. With a standard iOS or Android device, you can rely on several out-of-the-box defenses designed to protect apps, data, and users. But when smartphones are rooted or jailbroken, these defenses become weaker, and sometimes entirely redundant.
This is why app developers want to protect the integrity of their apps by detecting rooted or jailbroken devices. But that’s more difficult than it seems.
So how can you get it right? What are the most effective root/jailbreak detection tools today? And what’s the best approach for developers like you looking to protect their valuable intellectual property?
In this article, we explain everything you need to know about root/jailbreak detection for mobile apps.
What is rooting/ jailbreaking? Recapping the basics
Rooting or jailbreaking removes built-in restrictions on mobile devices, giving the end user admin-level permissions to make changes to their device. Rooting occurs on Android devices, and jailbreaking on iOS.
But rooting and jailbreaking aren’t new. Mobile users have been using these techniques to remove smartphone controls for as long as manufacturers have been implementing them. As new rooting/jailbreaking techniques emerge, identifying such devices only grows more difficult.
Read more: Root detection: What it is and how it works
Why do people root or jailbreak devices?
Sometimes, rooting or jailbreaking is done directly by malicious actors. But usually, the mobile device owners perform it. There are many reasons they might do it:
- User interface: Users may wish to change default device settings, like installing custom fonts, removing bloatware, or changing other settings.
- Game cheats: Elevated permissions allow end users to install cheats, workarounds, and mods for games on their mobiles.
- Installing apps: Most iOS devices only let you install apps from the App Store, and Android devices from Google Play Store. End users avoid these restrictions by jailbreaking.
- Security/pen testing: Security researchers and hackers often need admin rights to perform security research. This can be either for legitimate reasons (like pen testing) or malicious ones (like reverse engineering).
- Manufacturer limitations: Users may choose to jailbreak devices to circumvent manufacturer limitations like regional restrictions and carrier locking.
- App controls: Rooted/jailbroken devices also allow users to get around app-specific restrictions, including in-app purchases, regional controls, feature limitations, and more.
The danger of rooting/jailbreaking
Whatever the reason for rooting/jailbreaking, such devices come with their own challenges, particularly organizations whose apps are downloaded and run on them. These include:
- Malware: Rooted and jailbroken devices are more susceptible to malware than standard mobile devices. While jailbreaking/rooting tools generally try to keep malware protections intact, this isn’t always possible. So, there is an increased risk of malware infecting your apps via freeware or decoy/repackaged apps.
- Vulnerabilities: Jailbroken devices can’t receive software updates because successful jailbreaking relies on exploiting vulnerabilities. This is why jailbroken iOS devices will almost certainly end up accumulating software vulnerabilities over time. This is less of an issue on Android devices because rooting doesn’t usually involve vulnerabilities.
- App misuse: End users can use jailbreaking/rooting to misuse apps, particularly gaming/streaming ones for which providers need to build rules around gameplay, regional restrictions, and in-app purchases.
- Data breach: Admin-level rights also make it easier for malicious actors to steal sensitive app data because jailbreaking/rooting removes the sandboxes designed to prevent data from leaving apps. This creates a security and compliance risk for app vendors.
- Loss of sensitive information: Hackers use rooted/jailbroken devices to analyze the app during runtime to reverse engineer an app’s internal logic. This risks code injection, repackaging, vulnerability exploitation, and other issues.
In short, app manufacturers have reasons to be wary of rooted/jailbroken devices, especially for apps involving sensitive personal data that needs to be protected, like financial services apps.
The good news is there are several techniques and tools that can help you detect rooted/jailbroken devices. But the bad news is: it isn’t as simple as it may first appear.
How jailbreaking and root detection works
Rooting and jailbreaking might not be new—but neither are attempts to detect them. Over the years, this has created a cat-and-mouse game between those attempting to unlock their devices and the tools designed to detect this. In this section, we discuss some of the most common methods, considering the pros and cons of root detection and jailbreaking, and what other options are available.
Today, there are several common techniques. The app includes these features in its code, which activate on a user’s device when the app is installed. While these techniques aren’t perfect, they create an effective first layer of defense that can reduce your app’s exposure to rooted/jailbroken devices.
Here are some of the most common jailbreaking/ root detection methods:
- Identifying jailbreaking/root management apps: End users install these apps to easily root or jailbreak their own devices. So, the presence of these apps generally indicates a rooted/jailbroken device, like:
Android: SuperSU, Magisk Manager, KingRoot
iOS: Cydia, Sileo, Zebra - Scanning device files: Rooting/jailbreaking tools often create specific files on the device, including packages, binaries, and directories. Identifying these files is one of the most common ways to detect elevated privileges on a device.
Android: Files like Superuser.apk and /system/xbin/su, packages like eu.chainfire.supersu and com.topjohnwu.magisk, and binaries like /system/bin/su binary. Many of these are specific to the rooting tool used, in this case, SuperSU and Magisk Manager.
iOS: Examples tend to be specific to the jailbreaking tool used, including: /private/var/tmp/cydia.log, /Applications/Cydia.app, /etc/apt, /usr/bin/sshd, /var/cache/apt. On iOS, particular binaries like “bash” and “sshd” are often present on jailbroken devices. - Detecting hooking frameworks: Hooking frameworks are used to alter an app’s behavior during runtime. This requires elevated privileges, so finding evidence of these hooking frameworks is another common rooting/jailbreak detection technique.
- Sandbox inspection: (iOS only) Standard iOS devices feature strong sandboxes to prevent sensitive information from leaving apps and to restrict the access that apps have to information on the wider device. Testing the integrity of sandboxes is an effective jailbreak detection method. It generally involves checking to see if you can access files that the sandbox would ordinarily restrict access to.
- Analyzing build or system properties: (Android only) Properties like ro.build.tags, ro.build.type, ro.debuggable, ro.secure, and ro.mock.location are often altered on rooted devices. If these deviate from a typical Android device, it could signal rooting.
When your app discovers evidence of rooting/jailbreaking, there are several options for how you can proceed:
- Issuing a warning to the end user
- Blocking access to particular features
- Blocking access to server-side resources
- Terminating the app entirely
- Notify the server to ban the user account
Generally, root/jailbreak detection tools allow app manufacturers to customize these responses so you can choose what the best response is for your app and data.
Some of the techniques we described in this chapter are easier to bypass than others. When rooting/jailbreaking is performed through pre-packaged apps by non-technical users, root detection can be quite effective. But as we’ll discover, this isn’t always the case.
For developers looking for a comprehensive and seamless game protection solution, JikGuard Game Protection offers cutting-edge encryption and anti-cheat technology to ensure your game remains secure without compromising performance.Why Choose JikGuard Game Protection?
On-Demand Security Assessment:
Not sure if your game needs encryption? JikGuard provides free security testing and reports, helping you identify potential risks through penetration testing and in-depth analysis.Minimal Performance Impact:
JikGuard’s encryption system only decrypts resources when needed, ensuring that files remain encrypted in the cache and have virtually no effect on loading speed or game smoothness.Seamless Multi-Channel Packaging:
Supports mother package encryption, meaning all sub-packages remain protected without requiring additional processing for different distribution channels.No SDK Required:
Unlike traditional solutions, JikGuard does not require SDK integration—simply run a command, and the encryption process is handled automatically.Ultra-Low Performance Overhead:
▪ CPU usage increase: <0.2%▪ Memory consumption: <1MB
▪ Startup time increase: <25ms
▪ Package size increase: <1.3MB
Ensuring a smooth and seamless gaming experience.
With JikGuard Game Protection, you can focus on game development while ensuring top-tier security against cheats, resource leaks, and competitive analysis. Protect your game today and keep your vision intact!
Where to go from here
Root and jailbreak detection remains a relevant, yet imperfect, aspect of mobile app security. The evolving landscape of rooting/jailbreaking, coupled with increasingly restricted app permissions, necessitates a more comprehensive, layered security strategy. By shifting the focus towards mitigating the underlying risks associated with rooted/jailbroken devices—like code injection, reverse engineering, and data breaches—you can build more resilient applications.
Ultimately, a combination of proactive detection and robust preventative measures offers the most effective approach to safeguarding sensitive data and intellectual property in an increasingly complex mobile environment.
