Prevent App Modifications with Checksum Verification

Checksum verification for mobile apps is table stakes for any mobile app developer that wants to, well, try to stop their app from being hacked, filled with malicious code, becoming self-aware and taking over the world. Too far? I think that may have been too far. Terminator references aside, you’ve put a lot of time and resources into developing a really cool app. You’ve released that app to the world and people are downloading it. In fact, it’s so popular that someone tries to modify your code to do truly nefarious things like steal data and redirect you to illegitimate sites.

This blog will take a closer look at checksum verification for mobile apps and how it is used to prevent any app modifications. It will also explore a few of the ways Appdome can help. Happy reading!

Prevent App Modifications with Checksum Verification

Checksums are a way to ensure the integrity of a file. A mobile app is a file. Better said, the mobile app binary is a file. Any change in a mobile app that uses checksum verification will impact the checksum calculation. Running a mobile app with malicious app modifications causes the checksum verification to fail and should result in the app exiting.

Another way to think about checksum verification is that checksum verification helps ensure the mobile app is what the user expected. If you’ve written your mobile app to take advantage of checksum verification, it greatly increases the difficulty of an attacker modifying your app successfully. For a bit more background on checksum verification, there is an interesting piece on Appleinsider: How to verify checksums when you download an app for your Mac.

How Appdome uses Checksum Verification

Appdome’s security features are only added to a mobile app by choice. When you build an app, we process a checksum of your app and the built code to ensure integrity. The checksum is encrypted and embedded into the final, built app. Furthermore, this checksum is calculated and used as an encryption key for the Appdome-built app, to apply a “seal” to the app. This process is called “checksum verification and sealing.”  When an Appdome-built app runs, the Appdome fusion adapter attached to the app checks to ensure that there is no mismatch in the checksum.  If there is, the fusion adapter will cause the app to exit.

Checksum Verification is part of ONEShield™, Appdome’s app shielding solution.

Thanks for reading! This blog is part of a series focused on Mobile Security Basics, which is appropriate for readers of any level looking to increase their overall mobile security knowledge.

Alan Bavosa

Alan is a product specialist at appdome who loves helping mobile developers use a cyber defense automation platform to protect Android & iOS apps in seconds.

Have a Security Project?

We Can Help!

GilWe're here to help
We'll get back to you in 24 hours to schedule your demo.

Quick Links for This Blog

Want to learn more?

Stay up to date with the DevSecOps Evolution.

Subscribe to our Mobile DevSec Blogs

More To Explore

Build What You Love Automate What You Don’t

Drop us a line and keep in touch

Search Appdome Solutions

3f0fcc71 0fcd 4d11 8187 0554f04e965e

How to Comply with the OWASP MASVS Standard

The OWASP MASVS (Mobile Application Security Verification Standard) is a standard that establishes mobile app security requirements for developers to build secure mobile apps and security teams to test mobile apps. On Appdome, brands can easily comply with the OWASP MASVS standard.

Spear Phishing Attacks Blog

AI Has Democratized Spear Phishing Attacks, Now What?

Spear phishing attacks used to be limited to high-profile targets such as CEOs, politicians, and other influential individuals. These attacks required extensive research, preparation, and coordination, making them a…