Prevent App Modifications with Checksum Verification

Checksum verification for mobile apps is table stakes for any mobile app developer that wants to, well, try to stop their app from being hacked, filled with malicious code, becoming self-aware and taking over the world. Too far? I think that may have been too far. Terminator references aside, you’ve put a lot of time and resources into developing a really cool app. You’ve released that app to the world and people are downloading it. In fact, it’s so popular that someone tries to modify your code to do truly nefarious things like steal data and redirect you to illegitimate sites.

This blog will take a closer look at checksum verification for mobile apps and how it is used to prevent any app modifications. It will also explore a few of the ways Appdome can help. Happy reading!

Prevent App Modifications with Checksum Verification

Checksums are a way to ensure the integrity of a file. A mobile app is a file. Better said, the mobile app binary is a file. Any change in a mobile app that uses checksum verification will impact the checksum calculation. Running a mobile app with malicious app modifications causes the checksum verification to fail and should result in the app exiting.

Another way to think about checksum verification is that checksum verification helps ensure the mobile app is what the user expected. If you’ve written your mobile app to take advantage of checksum verification, it greatly increases the difficulty of an attacker modifying your app successfully. For a bit more background on checksum verification, there is an interesting piece on Appleinsider: How to verify checksums when you download an app for your Mac.

How Appdome uses Checksum Verification

Appdome’s security features are only added to a mobile app by choice. When you build an app, we process a checksum of your app and the built code to ensure integrity. The checksum is encrypted and embedded into the final, built app. Furthermore, this checksum is calculated and used as an encryption key for the Appdome-built app, to apply a “seal” to the app. This process is called “checksum verification and sealing.”  When an Appdome-built app runs, the Appdome fusion adapter attached to the app checks to ensure that there is no mismatch in the checksum.  If there is, the fusion adapter will cause the app to exit.

Checksum Verification is part of ONEShield™, Appdome’s app shielding solution.

Thanks for reading! This blog is part of a series focused on Mobile Security Basics, which is appropriate for readers of any level looking to increase their overall mobile security knowledge.

Alan Bavosa

Alan is a product specialist at appdome who loves helping mobile developers use a unified defense automation platform to protect Android & iOS apps in seconds.

Have a Security Project?

We Can Help!

AlanWe're here to help
We'll get back to you in 24 hours to schedule your demo.

Quick Links for This Blog

Want to Learn More?

Stay up to date with the DevSecOps Evolution.

Subscribe to our Mobile DevSec Blogs

More To Explore

Build What You Love Automate What You Don’t

Drop us a line and keep in touch

Search Appdome Solutions

Search
Blog Post Ciso 5.0

CISO 5.0 – Cyber as a Business Function

Cybersecurity has undergone a profound transformation over the past two decades. Once a narrowly scoped discipline focused on control and compliance, the Chief Information Security Officer (CISO) role has…

Blog Post Why Cyber Platforms Matter

Why Cyber Platforms Matter in Your AI Strategy

Palo Alto Networks and Crowdstrike have made it clear that platforms are the right strategy for cyber defense initiatives. And platforms do offer a lot of advantages over manual defense options – faster time to market, just-in-time defense, better compliance …

Blog Post White Box Cryptography Is A Sham

White-box Cryptography is a Sham

I’ve worked with our cyber research team, providing assessments of mobile apps for mobile banks and brands, and it always surprised me to see that API endpoints and API…