Prevent App Modifications with Checksum Verification

Checksum verification for mobile apps is table stakes for any mobile app developer that wants to, well, try to stop their app from being hacked, filled with malicious code, becoming self-aware and taking over the world. Too far? I think that may have been too far. Terminator references aside, you’ve put a lot of time and resources into developing a really cool app. You’ve released that app to the world and people are downloading it. In fact, it’s so popular that someone tries to modify your code to do truly nefarious things like steal data and redirect you to illegitimate sites.

This blog will take a closer look at checksum verification for mobile apps and how it is used to prevent any app modifications. It will also explore a few of the ways Appdome can help. Happy reading!

Prevent App Modifications with Checksum Verification

Checksums are a way to ensure the integrity of a file. A mobile app is a file. Better said, the mobile app binary is a file. Any change in a mobile app that uses checksum verification will impact the checksum calculation. Running a mobile app with malicious app modifications causes the checksum verification to fail and should result in the app exiting.

Another way to think about checksum verification is that checksum verification helps ensure the mobile app is what the user expected. If you’ve written your mobile app to take advantage of checksum verification, it greatly increases the difficulty of an attacker modifying your app successfully. For a bit more background on checksum verification, there is an interesting piece on Appleinsider: How to verify checksums when you download an app for your Mac.

How Appdome uses Checksum Verification

Appdome’s security features are only added to a mobile app by choice. When you build an app, we process a checksum of your app and the built code to ensure integrity. The checksum is encrypted and embedded into the final, built app. Furthermore, this checksum is calculated and used as an encryption key for the Appdome-built app, to apply a “seal” to the app. This process is called “checksum verification and sealing.”  When an Appdome-built app runs, the Appdome fusion adapter attached to the app checks to ensure that there is no mismatch in the checksum.  If there is, the fusion adapter will cause the app to exit.

Checksum Verification is part of ONEShield™, Appdome’s app shielding solution.

Thanks for reading! This blog is part of a series focused on Mobile Security Basics, which is appropriate for readers of any level looking to increase their overall mobile security knowledge.

Alan Bavosa

Alan is a product specialist at appdome who loves helping mobile developers use a cyber defense automation platform to protect Android & iOS apps in seconds.

Have a Security Project?

We Can Help!

TomWe're here to help
We'll get back to you in 24 hours to schedule your demo.

Quick Links for This Blog

Want to learn more?

Stay up to date with the DevSecOps Evolution.

Subscribe to our Mobile DevSec Blogs

More To Explore

Build What You Love Automate What You Don’t

Drop us a line and keep in touch

Search Appdome Solutions

Blog Post 4 Reasons Existing Waf Anti Bot Solutions Fail To Protect Mobile

4 Reasons Existing WAF Anti-Bot Solutions Fail To Protect Mobile

Traditional anti-bot solutions, like Web Application Firewalls (WAFs), struggle to protect against most mobile-based attack vectors, resulting in significant blind spots in organizations’ API defenses, highlighting the need for advanced mobile-specific bot defense solutions.