Mobile Application Shielding for Android Version 7.3.1-a (April 2025)
- 30 Apr 2025
- 6 Minutes to read
- Print
- DarkLight
- PDF
Mobile Application Shielding for Android Version 7.3.1-a (April 2025)
- Updated on 30 Apr 2025
- 6 Minutes to read
- Print
- DarkLight
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
Introduction
Welcome to Mobile Application Shielding for Android 7.3.1-a!
The OneSpan Customer Portal only accepts connections via TLS 1.2 or later. Earlier versions are no longer supported because all versions of the TLS protocol prior to 1.2 have been deprecated.
This is a release of Mobile Application Shielding, which contains enhancements and other product updates. For more information about new features and fixed defects, refer to the respective chapters in this document. For information about configuring and using Mobile Application Shielding, see the Mobile Application Shielding Integration Guide.
To maintain protection against the latest mobile threats, ensure to update Mobile Application Shielding to the latest version!
Supported platform versions
App Shielding version 7.3.1-a was successfully tested with Android 15.
Android 5.0 (API level 21) – Android 15 (API level 35).
Shielding Tool:
Windows 10: 64-bit Java 17
Mac OSX (10.9+)
Ubuntu Linux 20.04 LTS or 22.04 LTS
Android platform updates
The Android minimum supported version is 5.0 (API level 21). This version of App Shielding supports Android 15.
If you want your protected app to run on Android 15, you must upgrade to App Shielding 6.6.0 or later.
Beginning with Android 15, Android supports devices that are configured to use a page size of 16 KB (i.e., 16 KB devices). App Shielding has been updated to work on these 16 KB devices. However, if your app uses any native libraries, you must ensure that these libraries are ready for 16 KB page sizes. For more information, refer to the Android Developer documentation.
As of March 1, 2025, App Shielding for Android version 5.7.1.98641 and earlier are no longer supported. For more information, refer to the OneSpan Mobile Portal or the OneSpan Customer Portal.
Deprecations
Platform minimum supported versions
Android 4.4 (API levels 19 and 20) are no longer supported by App Shielding. The new minimum supported version is Android Lollipop 5.0 (API level 21).
Android Native Development Kit (NDK)
Google has announced that Android Native Development Kit (NDK) (r26) will no longer support KitKat (API levels 19 and 20). The minimum version supported by the NDK for r26 will be Lollipop (API level 21).
App Shielding switches to NDK r26 after its release as LTS version.
Deprecated API: ShieldSDK-secure-edit-text
The ShieldSDK-secure-edit-text API has been marked as deprecated. It is no longer maintained and is considered obsolete. It will be removed in an upcoming release.
Deprecated configuration option removed: Allow work profile and device vendor virtual spaces
The Allow work profile and device vendor virtual spaces configuration option is now deprecated and has been removed. It has been replaced with the Check Private Space option.
For more information, see Configuration of App Shielding for Android apps.
New features and other updates
Uploading multiple certificates
App Shielding now offers the possibility to upload multiple certificates for the application signer certificate and the updatable configuration server certificate. With this, applications can be signed from different environments via the submitted configuration after the application has been shielded.
In the following scenarios, some of the uploaded certificates will be removed from your configuration:
When you use App Shielding 7.3.1-a and upload multiple certificates but then change to an earlier version of App Shielding, you must select which certificate to keep, the other certificates will be removed.
When you have uploaded multiple certificates but select in your configuration Application signer certificate > Original certificate, all the uploaded certificates will be deleted and App Shielding adds the original certificate.
Check Emulated Input
The check to verify if input to the application is emulated or physical has been enhanced. In addition to block emulated input, App Shielding can now be configured to check for emulated input, exit the application when emulated input is detected, and specify the URL of a web page to launch with an explanation. The Check Emulated Input configuration option is enabled by default, Block emulated input and Exit on Emulated Input are now disabled by default.
If you had Block emulated input enabled in a previous version of App Shielding, this setting is maintained, and the Check Emulated Input configuration option will be automatically enabled.
For more information, see Security Features on Android: Emulated Input, and for details how to configure this feature, see Configuration options for Android.
Bootloader status callback added to sample
The Android sample included in the App Shielding product package has been extended and now includes bootloader detection. The BOOTLOADER_STATUS callback and its BootloaderStatusData data class have been added, which contain information about the detected bootloader state.
For more information, see Security features on Android: Unlocked bootloader detection.
Known limitations
The limitations described here have not yet been solved for the current Mobile Application Shielding version. Possible workarounds are described where available.
Bypassing App Shielding protection in Cordova-based applications
Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:
It is not longer protected with App Shielding.
It is signed with a different developer certificate.
Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.
OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.
NFC payment failure in shielded apps with Thales Gemalto SDK
Description: When using the shielded version of the app, NFC payments fail. This is caused by a compatibility issue with the Thales Gemalto TSH Pay SDK which also provides debugger detection. The SDK incorrectly flags the App Shielding debugger detection as a native debugger.
Solution: Allowlisting. For implementations integrating both the Thales Gemalto SDK and App Shielding, debuggers coming from the SDK's own debugging processes and sub-processes should be added to an allowlist within theThales Gemalto SDK.
It is essential to not only add the processes to the allowlist but also their sub-processes. Otherwise, the SDK will still handle App Shielding as a native debugger!
Magisk and root hider tools on new Android versions
Root hider tools such as Magisk Hide are designed to hide the fact that the device is compromised (rooted). Android has been increasingly restricted in what can be inspected and observed of the system from inside an app. This means that a rooted system with a root hider tool can be hard to detect due to missing privileges.
On Android 8+, App Shielding may not able to reliably detect a rooted device with Magisk Hide depending on the version of these tools.
Android App Bundles
The OneSpan Customer Portal support for Android App Bundles does not yet include instant-enabled app bundles.
Was this article helpful?