This post is part two of a three-part series about mobile security. Today's post will discuss the execution of apps on jailbroken devices. Yesterday, we described some vulnerabilities in iOS web browsers. Tomorrow, we'll explore detecting jailbroken devices.
Three different messages but they say the same thing: the app will not execute on a jailbroken device. The question is though, is it a good idea for developers to block execution on jailbroken or rooted devices?
There is of course not a good answer to the question, and it depends on the app's purpose and the information it handles.
However, the decision to block execution on rooted or jailbroken devices should not be taken lightly. By blocking execution, you've got your work cut out for you. Jailbreak and root detection is not easy. If you decide to block execution on modified devices, you need to invest the time and get the necessary skills to implement detection that cannot be bypassed. I would argue that a root detection or jailbreak detection that can be bypassed is worse than not detecting root or jailbreak at all. Apps that try to block execution on modified devices can flag themselves as all the more interesting to a malicious individual.
Here are some of the tools you are up against (this is not a comprehensive list, it merely provides a few examples):
In our testing, we found that 14 percent of apps that attempted to block execution on rooted or jailbroken devices did so ineffectively. We were able to bypass the checks in hours and sometimes even in minutes.
Our research also points out the difficulty in detecting and blocking execution on a jailbroken device. Of apps that attempted to block execution on jailbroken or rooted devices, we managed to bypass the checks and execute the app on a modified device in every case.. Granted, some of the bypasses required heavy modifications of the operating system, and sometimes the app itself, but we were successful in the end.
In summary, you should not block execution of apps on rooted or jailbroken devices unless it is absolutely necessary for the security and/or integrity of the app. If you do decide to do so, make sure to understand the time and effort it will require and have the necessary resources available.