Verifying the Integrity of a Mobile Application
Any mobile application passes two major stages on its way to a mobile device: 1) a developer builds it, and then it 2) gets uploaded to a mobile store from which it gets installed on the user’s device.
But there’s a problem here, how does the application’s author/owner know that the application that is installed on the user’s device is the same application that left her build-system?
One of the methods to ensure no modifications occur is for the application to verify its own integrity using a checksum: a unique identifier that reflects the composition of the application (code, data, assets, etc..).
This Knowledge Base article summarizes the steps to add checksum validation to any mobile application using Appdome.
We hope you find it useful and enjoy using Appdome!
Adding Checksum Validation to Mobile Apps Without Coding
Appdome is a mobile integration platform as a service (iPaaS) that allows users to add a wide variety of features, SDKs, and APIs to Android and iOS apps. Using a simple ‘click to add’ user interface, Appdome allows anyone to easily integrate Checksum Validation into any mobile app – instantly, no code or coding required.
Using Appdome, there are no development or coding prerequisites. For example, there is no Appdome SDK, libraries, or plug-ins to implement. The Appdome technology adds Checksum Validation and relevant standards, frameworks and more to the app automatically, with no manual development work at all. Using Appdome, Checksum Validation will run on the application to validate its integrity.
Overview of checksum validation
Checksum Validation is a technique used in the security industry to calculate a unique fingerprint of information, binary data, and assets. By creating checksums, and validating them at run-time, Appdome prevents changes to your app, its resources, code, configuration and more.
Checksum Validation is a built-in part of the Appdome Mobile Security Suite, falls under ONEShield by Appdome.
Appdome’s security features are only added to a mobile app by choice. When you build an app, Appdome generates a checksum of your app and the fusion code to ensure integrity. The checksum is encrypted and embedded into the final, built app. Furthermore, this checksum is calculated and used as an encryption key for the built app, to apply a “seal” to the app.
This process is called “checksum validation and sealing”. When a built app runs, an integrity check is performed to ensure that there is no mismatch in the checksum. If there is a difference, the app will exit. For more information on checksum validation check out our blog. Also, for information on how checksum validation can be used to thwart mobile malware, check out this blog.
Prerequisites for adding checksum validation
In order to use Appdome’s no code implementation of Checksum Verification, you’ll need:
- Appdome account – IDEAL or Higher.
- Mobile App (.ipa for iOS, or .apk or .aab for Android)
- Signing Credentials (e.g., signing certificates and provisioning profile)
How to Add Checksum Validation to Any Mobile App on Appdome
Follow these step-by-step instructions to add Checksum Validation to Any Mobile App:
Upload a Mobile App to Your Account
From the “Build” tab, Add Checksum Validation
Select the Build Tab. Note: a blue underline will appear showing the step is active
- Click Build My App
Since Checksum Validation is part of ONEShield by Appdome, and ONEShield by Appdome is active by default for all built apps, there is no need to enable anything before Fusing the application.
Congratulations! You now have a mobile app fully integrated with Checksum Validation.
After Adding Checksum Validation to a Mobile App on Appdome
After you have added Checksum Validation to any Mobile App on Appdome, there are a few additional steps needed to complete your mobile integration project.
Add Context™ to the Appdome-Built App
Appdome is a full-featured mobile integration platform. Within Context™, Appdome users can brand the app, including adding a favicon to denote the new service added to the app.
For more information on the range of options available in Context™, please read this knowledge base article.
Sign the Checksum Validation enabled Appdome-Built App (Required)
In order to deploy an Appdome-Built app, it must be signed. Signing an iOS app and Signing an Android app is easy using Appdome. Alternatively, you can use Private Signing, download your unsigned app and sign locally using your own signing methods.
Deploy the Appdome-Built App to a Mobile Device
Once you have signed your Appdome-Built app, you can download to deploy it using your distribution method of choice. For more information on deploying your Appdome-Built apps, please read this knowledge base.
That is it – Enjoy Appdome with Checksum Validation in your app!
How Do I Learn More?
For more information on Appdome Mobile Security Suite please visit this resource.
To zoom out on this topic, visit Appdome for Mobile App Security on our website.