How to Test Secured Android Apps on BitBar, Mobile DevSecOps Best Practices

Last updated June 5, 2023 by Appdome

Learn how to test Appdome-secured Android Apps using BitBar’s mobile testing suite. Appdome is 100% compatible with all leading mobile application test automation solutions used by DevSecOps teams. Automated testing of secured Android app helps developers and others rapidly deploy comprehensive mobile app security and fraud prevention with DevSecOps speed and agility.

This knowledge base article covers the steps needed to test Appdome secured Android mobile apps by using BitBar’s mobile test automation suite.

Appdome works with all leading mobile automation testing solutions to help customers achieve comprehensive mobile app security at DevSecOps speed and agility, all within the app’s existing application lifecycle.

Testing on Android Apps

BitBar allows testing apps by using its Live Testing and Automation test suits. Both can be used to test Appdome-secured mobile apps. When using Bitbar to run Live App or App Automate tests on an Appdome-protected app, you can choose between either of the following methods:

Use Appdome’s Build-to-Test service (recommended)
Customers with an Appdome SRM license can use Appdome’s Build-to-Test service to quickly and easily test their Appdome-secured mobile apps by using BitBar, without the need for different Fusion Sets. With Appdome’s Build-to-Test service, Appdome’s in-app defense model recognizes the unique signature of these testing services and allows for easy testing without issuing a security alert or forcing the app to exit, even if these services use tools such as Magisk or Frida. For details, see How to Use Appdome Mobile App Automation Testing.
Use threat events
When using threat events, Appdome protection features may be triggered triggered due to the nature of BitBar’s test environment, thereby slowing down your work

The following table describes which Appdome protections may be triggered, why they are triggered, and how to avoid them (during the app build phase on Appdome).

Appdome Feature	Reason	How to Prevent Such Identification
Root Prevention	Some of Bitbar devices are rooted	Enable Threat Events for Root Prevention with In-App Detection mode – Appdome will detect the rooted devices, but will not close the app.
Detect Developer Options	Required to interact with the device – therefore, turned on in Bitbar’s devices	Enable Threat Events for Detect Developer Options with In-App Detection mode – Appdome will detect that the setting Developer options is enabled, but will not close the app. Developer options is an Android setting that allows developers to configure system behaviors for administrative and troubleshooting purposes.
Block Android Debug Bridge (ADB)	Required to interact with the device	Enable Threat Events for Block Android Debug Bridge (ADB) with In-App Detection mode – Appdome will detect ADB is enabled, but will not close the app. ADB is a very powerful and versatile command-line tool that allows communicating with Android devices or Android apps either remotely or via a USB interface to perform a wide range of actions by running and executing an extensive list of commands installing and debugging apps, and it provides access to the Android shell. While ADB is intended for use by legitimate developers in building, debugging, and troubleshooting Android apps, it can also be used by cybercriminals, fraudsters, and hackers for other purposes.
Android MiTM Prevention	Bitbar uses a MiTM proxy	Enable Threat Events for Android MiTM Prevention with In-App Detection mode – Appdome will detect MiTM (Man in The Middle) proxy, but will not close the app. Malicious proxies are often used in mobile MiTM attacks. Hackers target insecure networks and wifi connections and hijack the connection between a mobile app and the server that it’s trying to connect to. They then redirect the session to malicious proxies so they can harvest data, steal credentials, deposit malware, etc.

Threat-event Modes

In-App Detection – Appdome detects the attack or threat and passes the event in a standard format to the app for processing, namely: the choice how and when to enforce is made based on your app’s settings.
In-App Defense – When a security event is detected by Appdome, Appdome will pass the event from the Appdome layer to the app.
Appdome’s security engine will handle the event, the default behavior is for the app to exit after displaying a compromise notification to the end user (compromise notifications are customizable).

Preventing Protections from being Triggered for Root Prevention

To prevent security protections from being triggered for Root Prevention:

Go to Build > Security.
Go to the OS Integrity section.
Enable (toggle On) Root Prevention.
Select the check box Threat Events.
From the list of threat event type, select In-App Detection.

Preventing Protections from being Triggered for Detect Developer Options

To prevent security protections from being triggered for Detect Developer Options:

Go to Build > Security.
Go to the OS Integrity section.
Enable (toggle On) Detect Developer Options.
Select the check box Threat Events.
From the list of threat event type, select In-App Detection.

Preventing Protections from being Triggered for Block Android Debug Bridge (ADB)

To prevent security protections from being triggered for Block Android Debug Bridge (ADB):

Go to Build > Anti Fraud.
Go to the Mobile Fraud Prevention section.
Enable (toggle On) Block Android Debug Bridge (ADB).
Select the check box Threat Events.
From the list of threat event type, select In-App Detection.

Preventing Protections from being Triggered for MiTM Prevention

To prevent security protections from being triggered for Android MiTM Prevention:

Go to Build > Security.
Go to the Secure Communication section.
Enable (toggle On) Android MiTM Prevention.
Select the check box Threat Events.
From the list of threat event type, select In-App Detection.

Testing .aab Apps

Unlike .apk apps, .aab apps must be re-signed before installation.

To avoid triggering Appdome’s Anti Tampering protection as a result of the re-signing process, use any of the following options:

Use Appdome Private Sign with the following BitBar’s private SHA1 signing key: 8DF593C1B6EAA6EADADCE36831FE82B08CAC8D74
Convert the test .aab app into Universal.apk, by using the same key that was used for signing the .aab app, and use the Universal.apk file to test with Bitbar
Go to ONEShield™ by Appdome in any of the tabs, enable Threat Events for the Anti-Tampering feature and select the In-App-Detection mode

Live App testing – Android

To initiate App Live test of your test app in BitBar:

Log in to your BitBar account. Alternatively, if you do not yet have an account, Create an account.
Under Live Testing click Start Mobile App Live Test.
Select a device or a device group (shown on the right side) from the displayed list.

If you see only iOS devices while you want to test an Android app – scroll down. The list is alphabetically sorted by Manufacturer so Apple devices will probably show first. Alternatively, you can use filters (on the left) to find a device matching your preferences.

After a device is selected, it will be displayed on the screen. Various device-related options are displayed on the right and an additional menu is displayed on the bottom left side.
Click Files on the left-side menu, and then Upload or choose files +.

A file library with the previously uploaded app files is displayed.
Select the app you would like to test, thus installing and launching the selected app on the test device.
If you have not yet uploaded the test app, upload it now by clicking Upload File button on the top, and then select it.
Perform your tests manually.
Click STOP when done.
Test session details will be displayed, and the test results will be available for later view under Live Testing > Test Results.

Automation App Testing – Appium Android Client Side

BitBar does not have specific Appium capabilities that trigger Appdome’s protection. However, it is important to follow the app building recommendations on Appdme, as previously described in sections Testing on Android Apps and Testing .aab Apps.

Automation App testing – Android Server Side

BitBar allows you to test your app by uploading your test code and running it on their cloud, using various automation frameworks such as Appium, Robot, and Selenium.

To test your app on the Android server side:

After successfully building and signing your app on Appdome, log in to your BitBar account. Alternatively, if you do not yet have an account, Create an account.
Under Automation click Create Automated Test
Select Android as target OS type.
Use the Select a Frameworksection section to click Server Side (Appium and other frameworks).
Use the Choose Files section to click on Click to choose or upload file and select your test app and the test code (.zip) from the displayed list.
If the app and the test code file are not in the displayed list, click Upload File and upload your test app and the test code .zip file, then select both for testing.
Use the Choose Devices section to select any of the following options:
1. Use existing device group
  Allows you to provide the name of the previously created device group.
2. Use chosen devices
  Allows you to select the test device from the presented list of available devices.
3. Use currently idle devices
  Allows you to let BitBar select test devices that are currently idle.
  
  Slide the blue circle on the bar below to indicate the number of devices you want to include in the test.
Click Create and run automated test.
When done, click on Go to results.

Troubleshooting Tips

Most automation test tools can typically be used in one of two modes: emulator mode and manual mode (specific terms may vary according to the testing tool). If you use the automation test tool in “emulator mode” instead of “manual mode”, the Appdome-secured application will not run on the device. This is expected because Appdome ONEShield protects apps from running on emulators/simulators. Instead, you should run the automation test tool in manual mode.

If you see a message such as: “Application has violated security policies and it will be shut down”, this means that (1) techniques such as emulators, tampering, or reverse engineering are present, and (2) the Fusion Set does not contain Appdome Threat-Events. This is expected because Appdome ONEShield protects against those conditions. You can either remove the triggering condition or use Appdome Threat Events if applicable.

Thank you!

Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project.