Overview

This test verifies whether the app detects and responds to instrumentation and hooking attempts at runtime. For example, if the app does not terminate immediately when the following APIs or functions are hooked:

Warning

This list is just indicative, and each app may have its own defensive response mechanisms.

Out of Scope

This test does not assess the robustness or bypass-resistance of the hook detection mechanisms. Detection methods and bypass techniques evolve continuously, and determined attackers with sufficient time and resources can circumvent these protections, for example, by using advanced instrumentation mechanisms. These techniques should be part of a defense-in-depth strategy, not a standalone solution. See MASTG-BEST-0048 for best practices on implementing effective runtime hook detection.

Steps

  1. Use MASTG-TECH-0056 to install the app.
  2. Use MASTG-TECH-0095 to hook the relevant API calls.
  3. Exercise the app extensively to trigger as many flows as possible and enter sensitive data wherever you can.

Observation

The output should contain one of the following:

Evaluation

The test case fails if the hook executes successfully and returns the expected data, indicating the app lacks runtime integrity verification.

Expected False Negatives:

This test may produce false negatives if the selected hooks or traces do not cover the app's security-sensitive code paths, if the exercised flows do not trigger operations that process sensitive data, or if the app's runtime hook detection logic is implemented in a way that evades the instrumentation used in this test (for example, through obfuscation, dynamic loading, native code, anti-instrumentation techniques, or checks that run before the hooks are installed). In such cases, the absence of findings does not guarantee that the app has effective runtime hook detection, and additional manual reverse engineering or custom instrumentation may be required to identify and analyze runtime hook detection mechanisms.

Tickets liés

Liens
is related to MASTG-BEST-0048 Hardening Against Reverse Engineering Tools (iOS)