Android Question Implement Runtime Application Self Protection (RASP) at B4X

[irda]

Hello to all developers.

I’ve been developing Android apps for years, ever since the early versions of B4A, but this is the first time my app has undergone a security audit using Quokka.

It has analysed the app and flagged the following security vulnerability:

"T102. Medium. Runtime Application Self Protection (RASP) was not detected. Incorporate an open source or paid RASP library"

My question is whether there is already a library (I’ve looked for one but haven’t found it) within B4A, or a way to implement these RASP features in our application.

For those who aren’t aware, the purpose of RASP is to detect the following situations: Root, Debugger,Emulador, APK modificado, Firma APK, Xposed, Magisk, Frida, Hooking

There are free libraries, such as FreeRASP (https://github.com/talsec/Free-RASP-Android), but I wouldn’t know where to start when it comes to including or using it in our projects

Thank you all,

 

[Dr_JU]

Read this article and this other to, also check all that "foundational security weaknesses" (pattern-based programming) that Quokka talk.

Not to mention that check if; whether your APK meets all the necessary requirements for the actions that RASP performs, as well as whether it is properly registered in the Play Store and whether it complies with signature/privileged permissions, Play Integrity/attestation, developer verification, etc.

Google has become very picky about that. Also remember that no matter how long ago you programming; bugs, zero‑days, CVEs, etc. can remain in code and/or devices for years, and every one of them can change policies from one second to another.

Spoiler: Security

Keep in mind that if RASP can perform all those actions/operations and other things without requesting the necessary permissions and without forcing you to properly register the APK in the Play Store... it’s because it performs bypasses that others can also perform, and when a device is rooted... there’s little left to preserve the security and integrity of an APK.

Quokka recommending RASP is like Nvidia recommending OpenAI || homeopath “Dr. JU’s magic drops” || China recommending the use of DeepSeek and Huawei devices.

No dog bite the hand that feeds him.

 

[irda]

Thank you for the information, Dr_JU

The fact is that, one way or another, we have to implement these safety guidelines. I’m not sure if it’s possible to create a wrapper for Freerasp, for example, or if it’s possible to programme the risk scenarios individually,

Best regards.

 

[Dr_JU]

The fact is that, one way or another, we have to implement these safety guidelines.

I understand, does it have to do with internal protocols and/or certifications vs compliance?

Here in my country (Argentina), although there is legislation regarding data and databases, there isn't really legislation regarding security; that’s left up to the creator.