Android and iOS

Anti-hooking and the protection of critical functions

Scope, trust models and the layers of application protection.

Protection foundations1 min readEditorial methods

Hooking allows a function's behavior to be observed or changed at runtime. Anti-hooking controls aim to limit the effect of that interference on an application.

Evaluation approach

First identify security-critical functions. An authentication decision that depends solely on a client-side return value is an architectural weakness.

Application example

The server verifies payment authorization while client controls generate interference signals. A change to one local function therefore cannot disable the business rule.

Limits and considerations

Treating every observation tool as an attack can create conflicts with diagnostic and accessibility tools.

Focus on behavior rather than the tool name

Looking for an analysis tool's name, default file or open connection may detect one installation pattern. It does not establish coverage of all function interference, nor does the absence of that tool prove that a critical function is unchanged.

Describe the security decision the test attempts to alter. Observing whether the server accepts the outcome is more useful than merely counting local alerts. Documenting the test target also makes it possible to reassess the same protection claim in the next release.

Checks and decisions

  • Map critical calls
  • Measure legitimate SDK effects
  • Test the business outcome

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.