Banking app detects Magisk Manager/app

[ScrambledBrain]

Hi,

Issue:

• Since version 2.7.1 from end of January of app TAN2go [com.starfinanz.mobile.android.dkbpushtan] the app now detects the Magisk app, not Magisk root system or something else.

Consequence:

• The app redirects then to a website after each start, where it states, that the app could not be started for some reasons ("non-proper" apps etc.)

Setup:

• OnePlus 7T Model HD1903
• Oxygen OS 10.0.16.HD65BA
• Magisk v22.0
• Magisk app v22.0 [already re-packed to a random name and apk]
• MagiskHide: enabled
• Module Universal SafeNet Fix v1.1.1: enabled
• Magisk SafetyNet test: successful
• Google Play Protect certification: device is certified
• MagiskHide the TAN2go app: enabled

Logs: TAN2go_working_with_Magisk_app_frozen.log TAN2go_not_working_with_Magisk_app_enabled.log

Workaround: => Freeze Magisk app to move it temporarily away while using the TAN2go app. I use "Ice Box" for (de-)freezing. AirFrozen or TitaniumBackup are other possibilities.

Risk: ~~Your device is not controlled by Magisk app when frozen and all started apps can use root permissions without interception! So, don't forget to de-freeze Magisk app directly after using the other app like TAN2go!~~ EDIT: Correction: Magisk proc_monitor is still running and handles hiding and permissions as I could see in logcat logs. So, the Magisk app is good for set and forget settings, but could be frozen without security issues. 😄

References: https://forum.xda-developers.com/t/dkb-tan2go-app-on-rooted-device.3835355/page-18 https://www.android-hilfe.de/forum/finanz-apps.912/dkb-banking-app-erkennt-root-trotz-magisk.901517-page-19.html#post-12465209

Request:

• Hide Magisk app against the detection.

Ideas: (from a user's point of view)

• best: trace or reverse-engineer TAN2go app to investigate the detection method
• tries: randomize the (re-packed) Magisk app icon or other detectable identification of Magisk

TAN2go app permissions:

• read phone status and identity
• retrieve running apps
• take pictures and videos
• receive data from Internet
• control flashlight
• view network connections
• reorder running apps
• control vibration
• full network access
• prevent device from sleeping

Thanks in advance.

[Tremolo4]

1. Read this #1152
2. Try un-hiding and hiding magisk manager again. The icon should be set to the default app icon. (I think this was implemented recently, so it will only apply for you if you un- and re-hide.)

[Jon8RFC]

Sorry to say that I couldn't make it work, either. I figured I could do my usual process when people post these problems, but it didn't work.

But, wow, great find with your workaround of freezing my repackaged magisk app. That absolutely does work for tan2go! Thank you for sharing...one more trick up our sleeves! I'll need to test this trick with a banking app my sister uses which is suddenly detecting magisk.

[ScrambledBrain]

2. Try un-hiding and hiding magisk manager again. The icon should be set to the default app icon. (I think this was implemented recently, so it will only apply for you if you un- and re-hide.)

I already did this, especially because of the new v22.0. But this didn't help. I believe, there is another detection method, but unfortunately I'm no developer to find this out.

1. Read this #1152

I read this. But there is the hope, that a developer here is interested to find out a maybe new detection method to circumvent this within MagiskHide.

I know this is a cat and mouse game.

https://medium.com/csg-govtech/diving-down-the-magisk-rabbit-hole-aaf88a8c2de0 was also very interesting to read. I know now some Magisk monitoring history: logcat, inotify, zygote ptrace and its dis-/advantages. But there is also something like isolated android processes and maybe some new detection methods.

Wouldn't it be the self-interest for the Magisk tools to catch these detection methods and fight against these? If some detection methods are found and will be implemented by most app developer, the usefulness of Magisk drops a lot.

The circumstances by using de-/freezing apps or isolated workspaces [island, ...] are too big for most users.

In the end many users would un-root its device, put in some ad-blocker as local VPN tunnel instead of systemless hosts file and Magisk will be used less often day by day.

The hope is there, that some forensic geek finds the needle in the [detection method] haystack ;D