Android
Insecure system propertiesRoot
Reads ro.debuggable and ro.secure to detect a debuggable / insecure build.
At a glance
- Platform
- Android
- Category
- Root
- Source
- IntegrityChecks.kt · checkRootDangerousProps
- Default status
- Makes status compromised
- Seen firing
- Not yet seen firing in a validated run. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0045
How it works
What the code inspects.
Reads ro.debuggable and ro.secure in-process through android.os.SystemProperties; if that hidden API is unavailable, falls back to one getprop dump per run (1-second timeout, shared with bootloader_unlocked). A build with ro.debuggable=1 or ro.secure=0 is an engineering/userdebug build with adbd running as root and relaxed restrictions.
If neither can be read the check throws, which marks the overall run incomplete (→ unknown) rather than silently passing.
The exploit it addresses
Why this matters.The threat.
ro.secure=0 / ro.debuggable=1 means root adb and a debuggable system: an attacker can run arbitrary commands as root over adb and attach to any app. Production devices ship the opposite values.
How it can be bypassed
No single check is sufficient.Known evasions.
An attacker with root can set these properties to the 'secure' values (ro.debuggable=0, ro.secure=1) using resetprop (Magisk) so the check sees a clean build.
Hiding frameworks spoof these properties specifically to pass SafetyNet/Play-Integrity-style checks.
An in-process hook (Frida, Xposed/LSPosed) on android.os.SystemProperties.get can return the 'secure' values to this app alone.
Blind on modern Android (verified on an Android 16 userdebug emulator, scenario S11): ro.debuggable and ro.secure are labelled userdebug_or_eng_prop, which apps can't read, so the app sees them empty and the check never fires — even on a debuggable build where the shell reads ro.debuggable=1. ro.build.type (userdebug / eng) stays readable and is the planned replacement.
Validation scenarios
Where this check is exercised.2 scenarios.
References & further reading
- MASTG-TEST-0045: Testing Root Detection (Android)Open ↗
https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/
- How Magisk works (systemless root, MagiskHide history)Open ↗
https://topjohnwu.github.io/Magisk/details.html
- Android signing builds (release-keys vs test-keys)Open ↗
https://source.android.com/docs/core/ota/sign_builds