Overview

At runtime, Android apps implementing enforced updating typically either invoke the Google Play In-App Updates API (for example, AppUpdateManager) or perform a custom version check, for example by retrieving BuildConfig.VERSION_NAME, BuildConfig.VERSION_CODE, or PackageManager.getPackageInfo values and sending them to a backend that returns a minimum version policy. If the app does not perform this check before access to protected functionality or backend services, or if the enforcement can be bypassed, for example by dismissing an update dialog, cancelling an immediate update flow, backgrounding the app before the update completes, or manipulating the reported version, the app fails to properly enforce the update.

This test checks whether the app triggers the expected update enforcement behavior at runtime by capturing version-related network traffic where applicable and hooking update-related API calls (MASTG-KNOW-0023).

Steps

  1. Use MASTG-TECH-0005 to install the app.
  2. Use MASTG-TECH-0010 to capture the app traffic.
  3. Use MASTG-TECH-0043 to hook the relevant API calls.
  4. Exercise the app extensively to trigger as many flows as possible and enter sensitive data wherever you can.

Observation

The output should contain:

Evaluation

The test case fails if the app does not perform a runtime update check, or if the update is not enforced at runtime.

Further Validation Required:

Using the backtraces from the hook output, inspect the code locations using MASTG-TECH-0023: