Jailbreak and Root Detection

A check an app runs as it opens, to see whether the phone has had the maker's limits taken off and can no longer keep apps apart.

Also known as root detection jailbreak detection device integrity check

Definition

A modified phone is one where the owner has taken away the limits the maker put there. On an iPhone people call this jailbreaking. On Android they call it rooting. Both give a person complete control of the device, and both are done on purpose, usually to install software the official shop will not allow.

That complete control is the problem. On a normal phone one app cannot read another app's data, because the phone keeps them apart. On a modified phone that wall is gone. A hidden program can read what your banking app is showing, copy the code that arrives by text message, or record every tap on the screen. Jailbreak and root detection is simply the app looking, at the moment it starts, for signs that it has landed on a phone like that.

This is why payment, health and staff apps look for it. An app that only shows a restaurant menu has little to lose. An app that moves money, opens a patient's file or holds salary records has plenty. Depending on how serious the risk is, the app may refuse to open at all, or it may let the person read and quietly block the parts that matter, such as a transfer.

Here is the part suppliers rarely mention. The check is a good guess, not a fact, and it is wrong in both directions. Somebody who knows what they are doing can hide the changes, so a truly modified phone passes. Meanwhile an honest customer on an older handset, on an unusual maker's version of Android, or on a work phone set up by their own employer, is refused with a message they cannot act on. They call support, who cannot see anything wrong either, and they buy from a competitor instead.

So the setting matters more than the feature. Linkysoft ships this check with a message that says what to try next, a record support can open to see why a phone was refused, and a written rule about which screens close and which stay open. Blocking everything at the first suspicion loses real customers, and that cost hides well, because those people simply stop trying. It is one of the first decisions we settle in a mobile app project, next to the wider security work that decides what the server does when a login looks strange. Linkysoft would rather tighten the server than shut out a paying customer.

Questions about Jailbreak and Root Detection

How do I know if my phone is jailbroken or rooted?
If you bought it new and never installed anything unusual, it almost certainly is not. Modifying a phone takes deliberate steps, so it does not happen by accident or through a normal update.
The app says my phone is not secure, but it is new. What now?
Ask support to look at the reason behind the refusal. Common innocent causes are a maker's own version of Android, a developer setting left switched on, or a work phone managed by an employer.
Should our app block a modified phone completely?
Only if the app moves money or holds health or salary records. For most apps it is better to allow reading and stop the risky actions, so an honest customer is not sent away.
Can a determined attacker get past the check?
Yes. Tools exist that hide the changes from most checks, so treat it as one lock among several. The server still has to watch for a strange login and a payment that does not fit the customer.
Does the check slow the app down or use my data?
It runs in a fraction of a second when the app opens and sends almost nothing. If an app feels slow to start, the cause is usually the images or the first screen, not this check.

Still not sure how this applies to your project?

Tell us what you are building and we will answer in plain language.