Introduction
Welcome to Mobile Application Shielding for Android 8.1.1-a!
This is a release of Mobile Application Shielding, which contains enhancements and other product updates. It also contains a compatibility release (App Shielding for Android 8.1.1-a-SDKcompat) to support compatibility with third party SDKs (e.g., payment SDKS).
Except for the compatibility feature, there are no differences between App Shielding for Android 8.1.1-a-SDKcompat and App Shielding for Android 8.1.1-a. Thus, no separate set of documents has been provided for the compat release.
For more information about new features and fixed defects, refer to the respective chapters in this article. For information about configuring and using Mobile Application Shielding, see the Mobile Application Shielding Integration Guide.
Supported versions
App Shielding
The minimum supported version is now App Shielding v6.5.1.120993.
Android
App Shielding version 8.1.1-a was successfully tested with Android 16.
Android 5.0 (API level 21) – Android 16 (API level 36).
Shielding Tool:
Windows 10: 64-bit Java 17
Mac OSX (10.9+)
Ubuntu Linux 22.04 LTS or 24.04 LTS
Android platform updates
The Android minimum supported version is 5.0 (API level 21). This version of App Shielding supports Android 16.
If you want your protected app to run on Android 15 or later, you must upgrade to App Shielding 6.6.0 or later.
Beginning with Android 15, Android supports devices that are configured to use a page size of 16 KB (i.e., 16 KB devices). App Shielding has been updated to work on these 16 KB devices. However, if your app uses any native libraries, you must ensure that these libraries are ready for 16 KB page sizes. For more information, refer to the Android Developer documentation.
New features and other updates
Introducing Premium Features: OneSpan Code Obfuscation
With this version, we are introducing Premium Features and launch OneSpan Code Obfuscation, as an extension to OneSpan Mobile Application Shielding. Use OneSpan Code Obfuscation to prevent reverse engineering and unauthorized modification of your app.
With its embedded Jigsaw engine, it protects JavaScript code in hybrid mobile applications with layered defenses, and native Android libraries. For JavaScript code protection, OneSpan Code Obfuscation combines obfuscation with other mechanisms. For native code obfuscation, advanced code protection is embedded directly into your binaries. The Jigsaw engine also provides strong binding to the App Shielding library, protecting the whole application from runtime attacks. Because the engine works directly on the machine code in the library, there are no limitations on the development tools that you can use to create your native components.
To implement this premium feature in your integration, you need a license for OneSpan Code Obfuscation. For information how to obtain this, please contact your sales representative. For more information about the feature, see the product documentation (valid license required to access the documents).
With a valid license you can enable this feature in the configuration for your shielding project in the OneSpan Mobile Portal.
Sample app update
For the introduction of the OneSpan Code Obfuscation feature, Native and Javascript libraries have been added to the Android sample app delivered with the product package.
Known limitations
The limitations described here have not yet been solved for the current Mobile Application Shielding version. Possible workarounds are described where available.
Build failures for Java/Kotlin sample
To resolve build failures of the Java/Kotlin sample app, edit the CMakeLists.txt file located in the cpp folder. Replace target_compile_features(native-lib PRIVATE cxx_std_17) with the following two lines:
set(CMAKE_CXX_STANDARD 11)
set(CMAKE_CXX_STANDARD_REQUIRED ON)With this change, the sample should build successfully.
Methods to block screenshots also block screen mirroring tools
Description: The methods used to block screenshots also block some screen mirroring tools. However, the scrcpy tool is only blocked on Android 12 and later. On Android 15, this option also blocks partial screen sharing.
Bypassing App Shielding protection in Cordova-based applications
Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences:
It is no longer protected with App Shielding.
It is signed with a different developer certificate.
Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application.
OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk.
NFC payment failure in shielded apps with Thales Gemalto SDK
Description: When using the shielded version of the app, NFC payments fail. This is caused by a compatibility issue with the Thales Gemalto TSH Pay SDK which also provides debugger detection. The SDK incorrectly flags the App Shielding debugger detection as a native debugger.
Solution: Allowlisting. For implementations integrating both the Thales Gemalto SDK and App Shielding, debuggers coming from the SDK's own debugging processes and sub-processes should be added to an allowlist within theThales Gemalto SDK.
It is essential to not only add the processes to the allowlist but also their sub-processes. Otherwise, the SDK will still handle App Shielding as a native debugger!
Magisk and root hider tools on new Android versions
Root hider tools such as Magisk Hide are designed to hide the fact that the device is compromised (rooted). Android has been increasingly restricted in what can be inspected and observed of the system from inside an app. This means that a rooted system with a root hider tool can be hard to detect due to missing privileges.
On Android 8+, App Shielding may not able to reliably detect a rooted device with Magisk Hide depending on the version of these tools.