flagged as insecure / outdated root detection (OWASP MASTG-KNOW-0027) and unreliable on modern Android devices (refs #5525, #2495)

Aperta
  • Qualcosa non va?
#8,099 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
android, java
Ambito
mobile-dev, security

Direzione di ricerca

Inizia da firebase-crashlytics/src/main/java/com/google/firebase/crashlytics/internal/common/CommonUtils.java, in corrispondenza di isRooted(), intorno alla riga 321. Esamina il comportamento descritto per Android 10, 12 e 13+, quindi confronta le segnalazioni correlate in #5525 e #2495. Il lavoro è completato quando il comportamento del rilevamento del root è affidabile negli ambienti segnalati, oppure quando il suo stato di funzionalità non adatta a scopi di sicurezza è chiaramente documentato, contrassegnato come deprecated o rimosso.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

api: crashlytics
[READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in the code in this repository. If you have a general
question, need help debugging, or fall into some other category use one of these other channels:

  • For general technical questions, post a question on StackOverflow
    with the firebase tag.
  • For general Firebase discussion, use the
    firebase-talk google group.
  • For help troubleshooting your application that does not fall under one of the above categories,
    reach out to the personalized Firebase support channel.
[REQUIRED] Step 2: Describe your environment
  • Android Studio version: Otter 2025.2.3
  • Firebase Component: Crashlytics (Database, Firestore, Storage, Functions, etc)
  • Component version: 19.4.0 -> latest
[REQUIRED] Step 3: Describe the problem

The method CommonUtils.isRooted() is currently being flagged by third-party independent security researchers during mobile application assessments based on OWASP Mobile Application Security Testing Guide (MASTG), specifically MASTG-KNOW-0027: Root Detection.

While OWASP clearly states that root detection is not a vulnerability by itself, the current implementation in Firebase appears to:

Rely on outdated / simplistic heuristics (e.g., static file checks, basic binaries presence).
Produce unreliable results on modern Android versions, including false positives and false negatives.
Not align with modern root detection practices (multi-layered, runtime-aware, obfuscation-resistant approaches).
Be easily bypassable, which reduces its value even as a soft anti-tampering signal.

Additionally, this method has already shown instability and incorrect behavior on newer Android devices, as discussed in:

Issue #5525 (detection on Android 13+)
Issue #2495 (detection on emulators)

These reports suggest that isRooted() may no longer behave consistently across API levels and device configurations (e.g., scoped storage, system-as-root, modern SELinux policies, Magisk hiding, etc.).

Steps to reproduce:

Use Firebase Crashlytics in an Android app.
Run the app on:

  • Android devices across modern API levels (Android 10 / 12 and 13+)
  • Either rooted (with Magisk hiding) or non-rooted device
    Observe:
  • Inconsistent isRooted() results depending on environment
  • Security scanners flagging the implementation as insufficient / non-compliant with OWASP recommendations

Security review tools specifically flag:

  • Static file path checks (/system/xbin/su, etc.)
  • Lack of runtime or behavioral checks
  • No mitigation for modern root-hiding techniques
Expected behavior:

CommonUtils.isRooted() should either:

  • Use a modern, more reliable root detection approach compatible with current Android versions, or
  • Be clearly documented (or deprecated/removed) as non-security-grade, so it is not flagged during security reviews.
    Given that Firebase Crashlytics is widely embedded across production applications, its internal utilities should not introduce audit friction or trigger OWASP-related findings in downstream apps.
Relevant Code:

https://github.com/firebase/firebase-android-sdk/blob/main/firebase-crashlytics/src/main/java/com/google/firebase/crashlytics/internal/common/CommonUtils.java#L321

Lingua principale
Java
Stelle
2.6k
Fork
733
Merge medio
2g 15h
PR unite (30g)
72

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di firebase/firebase-android-sdk

Tutte le issue di firebase/firebase-android-sdk

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.