Version 6.0.1 (September 2023)

The Android minimum supported version is Lollipop-5.0 (API level 21).

This version of App Shielding supports Android 14 beta 5 (API level 34).

Virtual app space detection can be enabled with the App Shielding check app in virtual space option.

If that option is enabled, App Shielding detects if the application was launched as a copy inside applications such as Parallel Space, Dual Space, or similar. App Shielding can also detect virtual app spaces and work profiles or managed devices provided by device vendors such as Google Workspace, Samsung Secure Folder, Xiaomi Dual Apps, Microsoft Workspace, etc. By default these are not reported as "virtual app spaces", but you can use the allow work profile and device vendor virtual spaces App Shielding configuration setting to report those as well as "virtual app space".

If App Shielding is configured with blockScreenshots to block screenshots from being taken of the app, then the Shielding Tool rule allowScreenshotsForActivity can be used to exclude an activity class from this block. That is, adding the following Shielding Tool rule tells App Shielding to allow screenshots if the specified activity is visible, even if blockScreenshots is enabled.

App Shielding has improved the detection of hooking frameworks, root hider applications, and native code hooks. Thus App Shielding Shield detects most versions of

• Frida/Frida stalker

• LSPosed

• Magisk Delta

• Magisk Manager

VMOS is an Android application, which can create emulators on an Android device. VMOS provides the possibility to create highly configurable emulator images. Some of these images may be rooted, some may have Xposed installed. VMOS Emulator detection is part of the check Emulator and exit On Emulator App Shielding settings.

Non-physical inputs (motion/keyboard events) are characterized as an emulated input. The emulated inputs might be originated from ADB, auto-click applications, screen-mirroring applications, screenreader applications, etc. The emulated input detection can be enabled with the check emulated input App Shielding configuration option.

The improved algorithm now detects more emulated input sources, for example, Vysor and Anydesk are now detected.

Allow Work Profile And Device Vendor Virtual Spaces

See Improved detection of Virtual Space Apps.

Check Untrusted Installer Mode

Configures the mode for the untrusted installer check (see the description of checkUntrustedInstaller in the Mobile Application Shielding Integration Guide). The option can be set to one of the following values:

• * "all"::
  Check all the apps that are installed on the device. This is the default value.

• * "sideloaded-apps-only"::
  Check only the apps that are sideloaded, that is, installed via adb.

Description: A performance regression was fixed where a shielded application unnecessarily spent too much time for some of its security checks.

Description: The Shielding Tool command line option --profile [release, debug] is deprecated. Now, the Shielding Tool uses release by default. Use --debug instead of --profile debug.

App Shielding supports the four architectures arm64-v8a, armeabi-v7a, x86_64, and x86.

If an application has native libraries, the Shielding Tool will add the App Shielding library for all architectures that are supported by the application.

Previously, Shielding Tool added App Shielding for all four architectures when the application had no native libraries. This has been changed to only add the arm64-v8a and armeabi-v7a architectures. With this, the shielded app will be smaller: the x86_64 and x86 App Shielding libraries add a size of ~5 MB to the application.

Description: Crashlytics needs a mapping.txt that contains entries for both obfuscated and not obfuscated classes and members. Previously, the Shielding Tool wrote only the classes and members that were obfuscated.

Status: This issue has been fixed. Now, the Shielding Tool also writes the names that are not obfuscated.

Description: The signer name of the installer of the untrusted source application was reported wrong, that is, the string returned by UntrustedSourceAppData.getUntrustedSourceAppInstallerSignerName(index). That return value was the signer name of the untrusted source application itself.

Status: This issue has been fixed.

The other data (signature, package name, etc.) are reported correctly.

Description: Android versions 12-14 have a new garbage collector (GC) implementation. This GC caused an ANR with App Shielding 5.6.0 resp. 5.0.5 and earlier.

Status: This issue has been fixed.

Description: The app version and app name (of the virtual space app) were switched.

Status: This issue has been fixed.

Description: On Android 13 or later it was possible to switch from a trusted to an untrusted keyboard while editing a text in the app without App Shielding noticing the change.

Status: This issue has been fixed. Now App Shielding detects such a change.

Description: Automated Google Play testing runs the application with the package ID androidx.test.tools.crawler.stubapp. That caused a shielded app to terminate unexpectedly.

Status: This issue has been fixed.

Description: Proguard/R8 started to obfuscate/minimize some members of the ShieldSDK-secure-app-rom classes. That caused applications to terminate unexpectedly that used the ShieldSDK-secure-app-rom.

Status: This issue has been fixed.

Description: If screen-mirroring is blocked, App Shielding reported in some situations in the callback that screen-mirroring was not blocked, though App Shielding did block it.

Status: This issue has been fixed.

Description: If the user switches to an untrusted keyboard while the application is running and the untrusted keyboard declares its service as export="false" (in its AndroidManifest.xml), App Shielding reported the previous keyboard data in the untrusted keyboard callback event. If a keyboard uses export="false", App Shielding cannot query the keyboard data (package name, signer, etc.).

Status: This issue has been fixed. With this fix, App Shielding will report empty names instead of the names of the previous keyboard.

Due to the nature of root hiding tools and the increasing restrictions Android imposes on applications as of Android 9, OneSpan Mobile Application Shielding may not be able to reliably detect a rooted device that uses root hiding tools.