Disable app functionality on a rooted device

[bkimondiu]

Observation We were able to install and use the mobile application using a rooted android phone

Impact Rooted devices and Jail broken devices can be used to access sensitive application files. This type of access can be utilised by an attacker to compromise the security of the application

Recommendations The application should be configured to check for rooted and jail broken devices. Upon initiation on a rooted or jail broken device, the application should not initialise.

[owais-vd]

@bkimondiu Could we show the alert dialog when a rooted device is detected like Alert: it looks like your device is rooted. and exit the app.

[bkimondiu]

I'm not sure what the appropriate solution would be in this case. I will tag @ekigamba @ukanga to weigh in on the issue.

[ekigamba]

@owais-vd @bkimondiu

• [x] Detect root at boot and delete all data if rooted
• [x] Detect root when the application opens and delete all data
• [x] Prevent app operation when the app is openned on a rooted device
• [x] Show a cancelleable screen with the message. STEPS app does not operate on rooted or jail-broken devices. Any previous data has been deleted for security reasons. Kindly install on an appropriate device or contact your system administrator. The app should close once the screen is cancelled/OK-ayed