flagged as insecure / outdated root detection (OWASP MASTG-KNOW-0027) and unreliable on modern Android devices (refs #5525, #2495)

Abierto
  • ¿Algo no está bien?
#8,099 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
android, java
Área
mobile-dev, security

Línea de trabajo

Comienza con firebase-crashlytics/src/main/java/com/google/firebase/crashlytics/internal/common/CommonUtils.java, en isRooted(), alrededor de la línea 321. Revisa el comportamiento descrito para Android 10, 12 y 13+, y después compara los informes relacionados en #5525 y #2495. Se considera terminado cuando el comportamiento de detección de root sea fiable en los entornos indicados, o cuando su condición de no tener un nivel de seguridad adecuado esté claramente documentada, marcada como deprecated o eliminada.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

api: crashlytics
[READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in the code in this repository. If you have a general
question, need help debugging, or fall into some other category use one of these other channels:

  • For general technical questions, post a question on StackOverflow
    with the firebase tag.
  • For general Firebase discussion, use the
    firebase-talk google group.
  • For help troubleshooting your application that does not fall under one of the above categories,
    reach out to the personalized Firebase support channel.
[REQUIRED] Step 2: Describe your environment
  • Android Studio version: Otter 2025.2.3
  • Firebase Component: Crashlytics (Database, Firestore, Storage, Functions, etc)
  • Component version: 19.4.0 -> latest
[REQUIRED] Step 3: Describe the problem

The method CommonUtils.isRooted() is currently being flagged by third-party independent security researchers during mobile application assessments based on OWASP Mobile Application Security Testing Guide (MASTG), specifically MASTG-KNOW-0027: Root Detection.

While OWASP clearly states that root detection is not a vulnerability by itself, the current implementation in Firebase appears to:

Rely on outdated / simplistic heuristics (e.g., static file checks, basic binaries presence).
Produce unreliable results on modern Android versions, including false positives and false negatives.
Not align with modern root detection practices (multi-layered, runtime-aware, obfuscation-resistant approaches).
Be easily bypassable, which reduces its value even as a soft anti-tampering signal.

Additionally, this method has already shown instability and incorrect behavior on newer Android devices, as discussed in:

Issue #5525 (detection on Android 13+)
Issue #2495 (detection on emulators)

These reports suggest that isRooted() may no longer behave consistently across API levels and device configurations (e.g., scoped storage, system-as-root, modern SELinux policies, Magisk hiding, etc.).

Steps to reproduce:

Use Firebase Crashlytics in an Android app.
Run the app on:

  • Android devices across modern API levels (Android 10 / 12 and 13+)
  • Either rooted (with Magisk hiding) or non-rooted device
    Observe:
  • Inconsistent isRooted() results depending on environment
  • Security scanners flagging the implementation as insufficient / non-compliant with OWASP recommendations

Security review tools specifically flag:

  • Static file path checks (/system/xbin/su, etc.)
  • Lack of runtime or behavioral checks
  • No mitigation for modern root-hiding techniques
Expected behavior:

CommonUtils.isRooted() should either:

  • Use a modern, more reliable root detection approach compatible with current Android versions, or
  • Be clearly documented (or deprecated/removed) as non-security-grade, so it is not flagged during security reviews.
    Given that Firebase Crashlytics is widely embedded across production applications, its internal utilities should not introduce audit friction or trigger OWASP-related findings in downstream apps.
Relevant Code:

https://github.com/firebase/firebase-android-sdk/blob/main/firebase-crashlytics/src/main/java/com/google/firebase/crashlytics/internal/common/CommonUtils.java#L321

Lenguaje dominante
Java
Estrellas
2.6k
Forks
733
Merge medio
2 d 15 h
PR fusionados (30 d)
72

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de firebase/firebase-android-sdk

Todos los issues de firebase/firebase-android-sdk

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.