freeRASP for Android
freeRASP for Android is a part of security SDK for the app shielding and security monitoring. Learn more about provided features on the freeRASP's main repository first.
| |
Usage
We will guide you step-by-step, but you can always check the expected result in the demo app. This is how final files should look like:
Step 1: Add Talsec to your Gradle
Set our nexus artifact repository in your project's build.gradle:
[build.gradle (NameOfProject)]
...
allprojects {
repositories {
google()
jcenter()
maven { url "https://nexus3-public.monetplus.cz/repository/ahead-talsec-free-rasp" }
}
}
Set release and debug dependencies in your :app module's build.gradle:
[build.gradle (:app)]
...
dependencies {
// Talsec Release
releaseImplementation 'com.aheaditec.talsec.security:TalsecSecurity-Community:3.1.0-release'
// Talsec Debug
debugImplementation 'com.aheaditec.talsec.security:TalsecSecurity-Community:3.1.0-dev'
...
Dev vs. Release version
Dev version is used during the development of application. It separates development and production data and disables some checks which won't be triggered during development process:
- Emulator-usage
- Debugging
- Signing
Step 2: Setup the Configuration for your App
- Create arbitrary subclass of
Application(), override it'sonCreate()and implement interface ofThreatListener.ThreatDetected. You can of course use your Application subclass, if you already have one in your project.
[TalsecApplication.kt]
class TalsecApplication : Application(), ThreatListener.ThreatDetected {
override fun onCreate() {
super.onCreate()
}
}
- Add this new subclass to
AndroidManifest.xml" inside
[AndroidManifest.xml]
<application
android:name=".TalsecApplication"
...
- Setup the Configuration for your App. Set up with your values
😉 . You can uncomment prepared helper functionLog.e(..)in theonCreate()to get expectedSigningCertificateHash easily (helper functions are in theUtils.kt):
[TalsecApplication.kt]
override fun onCreate() {
super.onCreate()
// Uncomment the following Log.e(...) to get your expectedSigningCertificateHash
// Copy the result from logcat and assign to expectedSigningCertificateHash
//Log.e("SigningCertificateHash", Utils.computeSigningCertificateHash(this))
...
The value of watcherMail is automatically used as target address for your security reports. Mail has a strict form '[email protected]'. You can assign just emptyArray() to supportedAlternativeStores if you publish on the Google Play Store and Huawei AppGallery as these are already included internally.
[TalsecApplication.kt]
companion object {
private const val expectedPackageName = "com.aheaditec.talsec.demoapp" // Don't use Context.getPackageName!
private const val expectedSigningCertificateHash = "mVr/qQLO8DKTwqlL+B1qigl9NoBnbiUs8b4c2Ewcz0k=" // Replace with your release (!) signing certificate hash
private const val watcherMail = "[email protected]" // for Alerts and Reports
private val supportedAlternativeStores = arrayOf(
// Google Play Store and Huawei AppGallery are supported out of the box, you can pass empty array or null or add other stores like the Samsung's one:
"com.sec.android.app.samsungapps" // Samsung Store
)
}
[TalsecApplication.kt]
override fun onCreate() {
...
// Uncomment the following Log.e(...) to get your expectedSigningCertificateHash
// Copy the result from logcat and assign to expectedSigningCertificateHash and
//Log.e("SigningCertificateHash", Utils.computeSigningCertificateHash(this))
val config = TalsecConfig(
expectedPackageName,
expectedSigningCertificateHash,
watcherMail,
supportedAlternativeStores
)
- Initiate ThreatListener and start Talsec just by adding these two lines below the created config:
[TalsecApplication.kt]
override fun onCreate() {
...
ThreatListener(this).registerListener(this)
Talsec.start(this, config)
}
Step 3: Handle detected threats
Implement methods of ThreatListener.ThreatDetected. For example you can kill app, warn user or send the event to your backend service.
[TalsecApplication.kt]
override fun onRootDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onDebuggerDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onEmulatorDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onTamperDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onUntrustedInstallationSourceDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onHookDetected() {
// Set your reaction
TODO("Not yet implemented")
}
override fun onDeviceBindingDetected() {
// Set your reaction
TODO("Not yet implemented")
}
And you're done
Is there any plan to change maven repo to jitpack or maven Central Repository
976 Dec 29, 2022
1 Feb 18, 2022
0 Jan 30, 2022
0 Nov 25, 2022
10 Dec 15, 2022
3 Oct 27, 2022
318 Dec 30, 2022
648 Dec 23, 2022
659 May 14, 2022
424 Dec 9, 2022
219 Nov 25, 2022
235 Dec 2, 2022
17 Nov 12, 2021
1.8k Dec 30, 2022
62 Dec 18, 2022
30 Nov 16, 2022
3 Oct 26, 2021
31 Dec 13, 2022