Checksum verification for mobile apps is table stakes for any mobile app developer that wants to, well, try to stop their app from being hacked, filled with malicious code, becoming self-aware and taking over the world. Too far? I think that may have been too far. Terminator references aside, you’ve put a lot of time and resources into developing a really cool app. You’ve released that app to the world and people are downloading it. In fact, it’s so popular that someone tries to modify your code to do truly nefarious things like steal data and redirect you to illegitimate sites.
This blog will take a closer look at checksum verification for mobile apps and how it is used to prevent any app modifications. It will also explore a few of the ways Appdome can help. Happy reading!
Prevent App Modifications with Checksum Verification
Checksums are a way to ensure the integrity of a file. A mobile app is a file. Better said, the mobile app binary is a file. Any change in a mobile app that uses checksum verification will impact the checksum calculation. Running a mobile app with malicious app modifications causes the checksum verification to fail and should result in the app exiting.
Another way to think about checksum verification is that checksum verification helps ensure the mobile app is what the user expected. If you’ve written your mobile app to take advantage of checksum verification, it greatly increases the difficulty of an attacker modifying your app successfully. For a bit more background on checksum verification, there is an interesting piece on Appleinsider: How to verify checksums when you download an app for your Mac.
How Appdome uses Checksum Verification
Appdome’s security features are only added to a mobile app by choice. When you build an app, we process a checksum of your app and the built code to ensure integrity. The checksum is encrypted and embedded into the final, built app. Furthermore, this checksum is calculated and used as an encryption key for the Appdome-built app, to apply a “seal” to the app. This process is called “checksum verification and sealing.” When an Appdome-built app runs, the Appdome fusion adapter attached to the app checks to ensure that there is no mismatch in the checksum. If there is, the fusion adapter will cause the app to exit.
Checksum Verification is part of ONEShield™, Appdome’s app shielding solution.
Thanks for reading! This blog is part of a series focused on Mobile Security Basics, which is appropriate for readers of any level looking to increase their overall mobile security knowledge.
