CAPEC-660: Root/Jailbreak Detection Evasion via Hooking
Description
An adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Adversaries may further leverage these capabilities to escalate privileges or bypass access control on legitimate applications. Although many mobile applications check if a mobile device is Rooted/Jailbroken prior to authorized use of the application, adversaries may be able to hook code in order to circumvent these checks. Successfully evading Root/Jailbreak detection allows an adversary to execute administrative commands, obtain confidential data, impersonate legitimate users of the application, and more.
- Likelihood of attack
- Medium
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- The targeted application must be non-restricted to allow code hooking.
Skills required
- HighKnowledge about Root/Jailbreak detection and evasion techniques.
- MediumKnowledge about code hooking.
Consequences
- IntegrityAuthorization
Execute Unauthorized Commands
Through Root/Jailbreak Detection Evasion via Hooking, the adversary compromises the integrity of the application.
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- ConfidentialityAccess Control
Read Data
An adversary may leverage Root/Jailbreak Detection Evasion via Hooking in order to obtain sensitive information.
Mitigations
- Ensure mobile applications are signed appropriately to avoid code inclusion via hooking.
- Inspect the application's memory for suspicious artifacts, such as shared objects/JARs or dylibs, after other Root/Jailbreak detection methods.
- Inspect the application's stack trace for suspicious method calls.
- Allow legitimate native methods, and check for non-allowed native methods during Root/Jailbreak detection methods.
- For iOS applications, ensure application methods do not originate from outside of Apple's SDK.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-MBTMemory Boundary Tracking1 shared
- D3-PCSVProcess Code Segment Verification1 shared
- D3-SFASystem File Analysis1 shared
- D3-PSEPProcess Segment Execution Prevention1 shared
- D3-SAORSegment Address Offset Randomization1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-HBPIHardware-based Process Isolation1 shared
- D3-PSAProcess Spawn Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.