freerasp-react-native 3.9.3 → 3.11.0

package/CHANGELOG.md

@@ -5,7 +5,56 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.0] - 2024-11-19
+
+### React Native
+
+#### Added
+
+- Added `adbEnabled` callback, which allows you to detect USB debugging option enabled in the developer settings on the device
+
+### Android
+
+#### Added
+
+- ADB detection feature
+
+## [3.10.0] - 2024-11-15
+
+-   Android SDK version: 12.0.0
+-   iOS SDK version: 6.6.3
+
+### React Native
+
+#### Added
+
+-  Added configuration fields for malware detection 
+
+### Android
+
+#### Added
+
+- New feature: **malware detection** as a new callback for enhanced app security
+
+#### Fixed
+
+- Refactoring Magisk checks in the root detection
+
+### iOS
+
+#### Added
+
+- Enhanced security with **[Serotonin Jailbreak](https://github.com/SerotoninApp/Serotonin) Detection** to identify compromised devices.
+
+#### Changed
+
+- Updated SDK code signing; it will now be signed with:
+  - Team ID: PBDDS45LQS
+  - Team Name: Lynx SFT s.r.o.
+
 ## [3.9.3] - 2024-10-28
+- Android SDK version: 11.1.3
+- iOS SDK version: 6.6.1
 
 ### iOS
 
@@ -13,6 +62,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Renewed the signing certificate
 
 ## [3.9.2] - 2024-10-18
+- Android SDK version: 11.1.3
+- iOS SDK version: 6.6.0
+
+-   Android SDK version: 11.1.3
+-   iOS SDK version: 6.6.0
 
 ### Android
 
@@ -47,7 +101,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Android
 
-#### Added 
+#### Added
 
 - Added the auditing of the internal execution for the future check optimization and overall security improvements.
 
@@ -65,7 +119,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### iOS
 
-#### Added 
+#### Added
 
 - [Dopamine](https://github.com/opa334/Dopamine) jailbreak detection.
 

package/README.md

@@ -10,7 +10,6 @@ freeRASP for React Native is a mobile in-app protection and security monitoring
 
 :loudspeaker: The official documentation has been moved to a new location. You can now find it [here](https://docs.talsec.app/docs-and-articles-portal). :loudspeaker:
 
-
 # Overview
 
 The freeRASP is available for Flutter, Cordova, React Native, Android, and iOS developers. We encourage community contributions, investigations of attack cases, joint data research, and other activities aiming to make better app security and app safety for end-users.
@@ -29,7 +28,7 @@ Key features are the detection and prevention of
 - Untrusted installation method
 - App/Device (un)binding
 
-Additional freeRASP features include low latency, easy integration and a weekly [Security Report](https://docs.talsec.app/freerasp/security-report ) containing detailed information about detected incidents and potential threats, summarizing the state of your app security.
+Additional freeRASP features include low latency, easy integration and a weekly [Security Report](https://docs.talsec.app/freerasp/security-report) containing detailed information about detected incidents and potential threats, summarizing the state of your app security.
 
 The commercial version provides a top-notch protection level, extra features, support and maintenance. One of the most valued commercial features is AppiCrypt® - App Integrity Cryptogram.
 
@@ -46,6 +45,11 @@ Learn more about commercial features at [https://talsec.app](https://talsec.app)
 
 Learn more about freemium freeRASP features at [GitHub main repository](https://github.com/talsec/Free-RASP-Community).
 
+## :radioactive: freeMalwareDetection
+**freeMalwareDetection** is a powerful feature designed to enhance the security of your Android application by quickly and efficiently scanning for malicious or suspicious applications (e.g. Android malware) based on various blacklists and security policies. It helps to detect apps with suspicious package names, hashes, or potentially dangerous permissions.
+
+After the integration of freeRASP, make sure you visit the [freeMalwareDetection](https://docs.talsec.app/freemalwaredetection) repository to learn more about this feature!
+
 # :book: Discover the Official freeRASP Documentation
 
 Visit the [GitBook page](https://docs.talsec.app/freerasp) for comprehensive and up-to-date guides, tutorials, and technical documentation specifically for freeRASP. It serves as your go-to resource, offering everything from basic instructions to advanced tips and tricks to help you get the most out of the project.
@@ -56,12 +60,6 @@ For integrating freeRASP on the React Native platform, be sure to follow all the
 
 Be sure to bookmark it and stay informed! :books: :sparkles:.
 
-## :scroll: Reference to Legacy Documentation
-
-If you have any suggestions for improvement or notice anything that could be clarified in the new GitBook documentation, please open an issue. Your feedback helps us maintain high-quality resources for all users. 
-
-For information on older integration methods, you can refer to the [freeRASP wiki](https://github.com/talsec/Free-RASP-ReactNative/wiki), which includes comprehensive legacy details and guidance. Additionally, the old integration can be found when you checkout to a specific tag. Your input is invaluable in helping us improve our resources and provide even better support for your needs.
-
 # :rocket: What's New and Changelog
 
 Stay informed and make the most of freeRASP by checking out [What's New and Changelog](https://docs.talsec.app/freerasp/whats-new-and-changelog)! Here, you’ll discover the latest features, enhancements, and bug fixes we’ve implemented to improve your experience across all platforms, including Android, iOS, Flutter, React Native, Capacitor, and Cordova. 
@@ -75,4 +73,4 @@ If you have any ideas for improvements, feel free to [raise an issue](https://gi
 You can check out the project board [here](https://github.com/orgs/talsec/projects/2).
 
 # :page_facing_up: License
-This project is provided as freemium software, i.e. there is a fair usage policy that imposes some limitations on the free usage. The SDK software consists of open-source and binary parts, which is the property of Talsec. The open-source part is licensed under the MIT License - see the LICENSE file for details.
+This project is provided as freemium software, i.e. there is a fair usage policy that imposes some limitations on the free usage. The SDK software consists of open-source and binary parts, which is the property of Talsec. The open-source part is licensed under the MIT License - see the LICENSE file for details.

package/android/build.gradle

@@ -11,6 +11,7 @@ buildscript {
     classpath "com.android.tools.build:gradle:7.2.1"
     // noinspection DifferentKotlinGradleVersion
     classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+    classpath "org.jetbrains.kotlin:kotlin-serialization:$kotlin_version"
   }
 }
 
@@ -20,6 +21,7 @@ def isNewArchitectureEnabled() {
 
 apply plugin: "com.android.library"
 apply plugin: "kotlin-android"
+apply plugin: 'kotlinx-serialization'
 
 if (isNewArchitectureEnabled()) {
   apply plugin: "com.facebook.react"
@@ -87,7 +89,8 @@ dependencies {
   //noinspection GradleDynamicVersion
   implementation "com.facebook.react:react-native:$react_native_version"
   implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
-  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:11.1.3"
+  implementation "org.jetbrains.kotlinx:kotlinx-serialization-json:1.4.1"
+  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:13.0.0"
 }
 
 if (isNewArchitectureEnabled()) {

package/android/src/main/java/com/freeraspreactnative/FreeraspReactNativeModule.kt

@@ -1,5 +1,6 @@
 package com.freeraspreactnative
 
+import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
 import com.aheaditec.talsec_security.security.api.Talsec
 import com.aheaditec.talsec_security.security.api.TalsecConfig
 import com.aheaditec.talsec_security.security.api.ThreatListener
@@ -12,8 +13,14 @@ import com.facebook.react.bridge.ReadableMap
 import com.facebook.react.bridge.UiThreadUtil.runOnUiThread
 import com.facebook.react.bridge.WritableArray
 import com.facebook.react.modules.core.DeviceEventManagerModule
-
-class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
+import com.freeraspreactnative.utils.getArraySafe
+import com.freeraspreactnative.utils.getBooleanSafe
+import com.freeraspreactnative.utils.getMapThrowing
+import com.freeraspreactnative.utils.getNestedArraySafe
+import com.freeraspreactnative.utils.getStringThrowing
+import com.freeraspreactnative.utils.toEncodedWritableArray
+
+class FreeraspReactNativeModule(private val reactContext: ReactApplicationContext) :
   ReactContextBaseJavaModule(reactContext) {
 
   private val listener = ThreatListener(FreeraspThreatHandler, FreeraspThreatHandler)
@@ -42,8 +49,7 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
 
       promise.resolve("freeRASP started")
 
-    }
-    catch (e: Exception) {
+    } catch (e: Exception) {
       promise.reject("TalsecInitializationError", e.message, e)
     }
   }
@@ -65,6 +71,7 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
     val channelData: WritableArray = Arguments.createArray()
     channelData.pushString(THREAT_CHANNEL_NAME)
     channelData.pushString(THREAT_CHANNEL_KEY)
+    channelData.pushString(MALWARE_CHANNEL_KEY)
     promise.resolve(channelData)
   }
 
@@ -87,6 +94,15 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
     // Remove upstream listeners, stop unnecessary background tasks
   }
 
+  /**
+   * Method to add apps to Malware whitelist, so they don't get flagged as malware
+   */
+  @ReactMethod
+  fun addToWhitelist(packageName: String, promise: Promise) {
+    Talsec.addToWhitelist(reactContext, packageName)
+    promise.resolve(true)
+  }
+
   private fun buildTalsecConfig(config: ReadableMap): TalsecConfig {
     val androidConfig = config.getMapThrowing("androidConfig")
     val packageName = androidConfig.getStringThrowing("packageName")
@@ -97,6 +113,14 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
       .supportedAlternativeStores(androidConfig.getArraySafe("supportedAlternativeStores"))
       .prod(config.getBooleanSafe("isProd"))
 
+    if (androidConfig.hasKey("malwareConfig")) {
+      val malwareConfig = androidConfig.getMapThrowing("malwareConfig")
+      talsecBuilder.whitelistedInstallationSources(malwareConfig.getArraySafe("whitelistedInstallationSources"))
+      talsecBuilder.blacklistedHashes(malwareConfig.getArraySafe("blacklistedHashes"))
+      talsecBuilder.blacklistedPackageNames(malwareConfig.getArraySafe("blacklistedPackageNames"))
+      talsecBuilder.suspiciousPermissions(malwareConfig.getNestedArraySafe("suspiciousPermissions"))
+    }
+
     return talsecBuilder.build()
   }
 
@@ -106,6 +130,8 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
       .toString() // name of the channel over which threat callbacks are sent
     val THREAT_CHANNEL_KEY = (10000..999999999).random()
       .toString() // key of the argument map under which threats are expected
+    val MALWARE_CHANNEL_KEY = (10000..999999999).random()
+      .toString() // key of the argument map under which malware data is expected
     private lateinit var appReactContext: ReactApplicationContext
     private fun notifyListeners(threat: Threat) {
       val params = Arguments.createMap()
@@ -114,11 +140,30 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
         .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
         .emit(THREAT_CHANNEL_NAME, params)
     }
+
+    /**
+     * Sends malware detected event to React Native
+     */
+    private fun notifyMalware(suspiciousApps: MutableList<SuspiciousAppInfo>) {
+      val params = Arguments.createMap()
+      params.putInt(THREAT_CHANNEL_KEY, Threat.Malware.value)
+      params.putArray(
+        MALWARE_CHANNEL_KEY, suspiciousApps.toEncodedWritableArray(appReactContext)
+      )
+
+      appReactContext
+        .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+        .emit(THREAT_CHANNEL_NAME, params)
+    }
   }
 
   internal object ThreatListener : FreeraspThreatHandler.TalsecReactNative {
     override fun threatDetected(threatType: Threat) {
       notifyListeners(threatType)
     }
+
+    override fun malwareDetected(suspiciousApps: MutableList<SuspiciousAppInfo>) {
+      notifyMalware(suspiciousApps)
+    }
   }
 }

package/android/src/main/java/com/freeraspreactnative/FreeraspThreatHandler.kt

@@ -39,7 +39,9 @@ internal object FreeraspThreatHandler : ThreatListener.ThreatDetected, ThreatLis
     listener?.threatDetected(Threat.ObfuscationIssues)
   }
 
-  override fun onMalwareDetected(p0: MutableList<SuspiciousAppInfo>?) {}
+  override fun onMalwareDetected(suspiciousAppInfos: MutableList<SuspiciousAppInfo>?) {
+    listener?.malwareDetected(suspiciousAppInfos ?: mutableListOf())
+  }
 
   override fun onUnlockedDeviceDetected() {
     listener?.threatDetected(Threat.Passcode)
@@ -53,11 +55,17 @@ internal object FreeraspThreatHandler : ThreatListener.ThreatDetected, ThreatLis
     listener?.threatDetected(Threat.DevMode)
   }
 
+  override fun onADBEnabledDetected() {
+    listener?.threatDetected(Threat.ADBEnabled)
+  }
+
   override fun onSystemVPNDetected() {
     listener?.threatDetected(Threat.SystemVPN)
   }
 
   internal interface TalsecReactNative {
     fun threatDetected(threatType: Threat)
+
+    fun malwareDetected(suspiciousApps: MutableList<SuspiciousAppInfo>)
   }
 }

package/android/src/main/java/com/freeraspreactnative/Threat.kt

@@ -23,6 +23,8 @@ internal sealed class Threat(val value: Int) {
   object ObfuscationIssues : Threat((10000..999999999).random())
   object SystemVPN : Threat((10000..999999999).random())
   object DevMode : Threat((10000..999999999).random())
+  object Malware : Threat((10000..999999999).random())
+  object ADBEnabled : Threat((10000..999999999).random())
 
   companion object {
     internal fun getThreatValues(): WritableArray {
@@ -39,7 +41,9 @@ internal sealed class Threat(val value: Int) {
           DeviceBinding.value,
           UnofficialStore.value,
           ObfuscationIssues.value,
-          DevMode.value
+          DevMode.value,
+          Malware.value,
+          ADBEnabled.value
         )
       )
     }

package/android/src/main/java/com/freeraspreactnative/models/RNSuspiciousAppInfo.kt

@@ -0,0 +1,25 @@
+package com.freeraspreactnative.models
+
+import kotlinx.serialization.Serializable
+
+
+/**
+ * Simplified, serializable wrapper for Talsec's SuspiciousAppInfo
+ */
+@Serializable
+data class RNSuspiciousAppInfo(
+  val packageInfo: RNPackageInfo,
+  val reason: String,
+)
+
+/**
+ * Simplified, serializable wrapper for Android's PackageInfo
+ */
+@Serializable
+data class RNPackageInfo(
+  val packageName: String,
+  val appName: String?,
+  val version: String?,
+  val appIcon: String?,
+  val installerStore: String?
+)

package/android/src/main/java/com/freeraspreactnative/utils/Extensions.kt

@@ -0,0 +1,116 @@
+package com.freeraspreactnative.utils
+
+import android.content.pm.PackageInfo
+import android.util.Base64
+import android.util.Log
+import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.ReactContext
+import com.facebook.react.bridge.ReadableArray
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableArray
+import com.freeraspreactnative.exceptions.TalsecException
+import com.freeraspreactnative.models.RNPackageInfo
+import com.freeraspreactnative.models.RNSuspiciousAppInfo
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import org.json.JSONException
+
+
+internal fun ReadableMap.getMapThrowing(key: String): ReadableMap {
+  return this.getMap(key) ?: throw TalsecException("Key missing in configuration: $key")
+}
+
+internal fun ReadableMap.getStringThrowing(key: String): String {
+  return this.getString(key) ?: throw TalsecException("Key missing in configuration: $key")
+}
+
+internal fun ReadableMap.getBooleanSafe(key: String, defaultValue: Boolean = true): Boolean {
+  if (this.hasKey(key)) {
+    return this.getBoolean(key)
+  }
+  return defaultValue
+}
+
+private inline fun <reified T> ReadableArray.toPrimitiveArray(): Array<T> {
+  val output = mutableListOf<T>()
+
+  for (i in 0 until this.size()) {
+    val element: T? = when (T::class) {
+      String::class -> this.getString(i) as T?
+      Int::class -> this.getInt(i) as T?
+      Double::class -> this.getDouble(i) as T?
+      Boolean::class -> this.getBoolean(i) as T?
+      else -> throw JSONException("Cannot parse JSON array - unsupported type")
+    }
+    element?.let(output::add)
+  }
+  return output.toTypedArray()
+}
+
+internal fun ReadableMap.getArraySafe(key: String): Array<String> {
+  if (this.hasKey(key)) {
+    val inputArray = this.getArray(key)!!
+    return inputArray.toPrimitiveArray()
+  }
+  return arrayOf()
+}
+
+internal fun ReadableMap.getNestedArraySafe(key: String): Array<Array<String>> {
+  val outArray = mutableListOf<Array<String>>()
+  if (this.hasKey(key)) {
+    val inputArray = this.getArray(key)!!
+    for (i in 0 until inputArray.size()) {
+      outArray.add(inputArray.getArray(i).toPrimitiveArray())
+    }
+  }
+  return outArray.toTypedArray()
+}
+
+
+/**
+ * Converts the Talsec's SuspiciousAppInfo to React Native equivalent
+ */
+internal fun SuspiciousAppInfo.toRNSuspiciousAppInfo(context: ReactContext): RNSuspiciousAppInfo {
+  return RNSuspiciousAppInfo(
+    packageInfo = this.packageInfo.toRNPackageInfo(context),
+    reason = this.reason,
+  )
+}
+
+/**
+ * Converts the Android's PackageInfo to React Native equivalent
+ */
+internal fun PackageInfo.toRNPackageInfo(context: ReactContext): RNPackageInfo {
+  return RNPackageInfo(
+    packageName = this.packageName,
+    appName = Utils.getAppName(context, this.applicationInfo),
+    version = this.versionName,
+    appIcon = Utils.getAppIconAsBase64String(context, this.packageName),
+    installerStore = Utils.getInstallationSource(context, this.packageName)
+  )
+}
+
+/**
+ * Convert the Talsec's SuspiciousAppInfo to base64-encoded json array,
+ * which can be then sent to React Native
+ */
+internal fun MutableList<SuspiciousAppInfo>.toEncodedWritableArray(context: ReactContext): WritableArray {
+  val output = Arguments.createArray()
+  this.forEach { suspiciousAppInfo ->
+    val rnSuspiciousAppInfo = suspiciousAppInfo.toRNSuspiciousAppInfo(context)
+    try {
+      val encodedAppInfo =
+        Base64.encodeToString(
+          Json.encodeToString(rnSuspiciousAppInfo).toByteArray(),
+          Base64.DEFAULT
+        )
+      output.pushString(encodedAppInfo)
+    } catch (e: Exception) {
+      Log.e("Talsec", "Could not serialize suspicious app data: ${e.message}")
+    }
+
+  }
+  return output
+}
+

package/android/src/main/java/com/freeraspreactnative/utils/Utils.kt

@@ -0,0 +1,82 @@
+package com.freeraspreactnative.utils
+
+import android.content.pm.ApplicationInfo
+import android.graphics.Bitmap
+import android.graphics.Canvas
+import android.graphics.drawable.BitmapDrawable
+import android.os.Build
+import android.util.Base64
+import android.util.Log
+import com.facebook.react.bridge.ReactContext
+import java.io.ByteArrayOutputStream
+
+
+internal object Utils {
+
+  private fun compressBitmap(bitmap: Bitmap): String {
+    val byteArrayOutputStream = ByteArrayOutputStream()
+    bitmap.compress(Bitmap.CompressFormat.PNG, 10, byteArrayOutputStream)
+    val byteArray = byteArrayOutputStream.toByteArray()
+    return Base64.encodeToString(byteArray, Base64.NO_WRAP)
+  }
+
+  /**
+   * Retrieves human-readable application name
+   */
+  internal fun getAppName(context: ReactContext, applicationInfo: ApplicationInfo?): String? {
+    return applicationInfo?.let { context.packageManager.getApplicationLabel(it) as String }
+  }
+
+  /**
+   * Retrieves app icon for the given package name as Drawable, transforms it to Bitmap,
+   * compresses to PNG and finally encodes the data to Base64
+   * @param context React Native context
+   * @param packageName package name for which icon should be retrieved
+   * @return Base-64 encoded string
+   */
+  internal fun getAppIconAsBase64String(context: ReactContext, packageName: String): String? {
+    try {
+      val drawable = context.packageManager.getApplicationIcon(packageName)
+
+      if (drawable is BitmapDrawable && drawable.bitmap != null) {
+        return compressBitmap(drawable.bitmap)
+      }
+
+      if (drawable.intrinsicWidth > 0 && drawable.intrinsicHeight > 0) {
+        val bitmap = Bitmap.createBitmap(
+          drawable.intrinsicWidth,
+          drawable.intrinsicHeight,
+          Bitmap.Config.ARGB_8888
+        )
+        val canvas = Canvas(bitmap)
+        drawable.setBounds(0, 0, canvas.width, canvas.height)
+        drawable.draw(canvas)
+        return compressBitmap(bitmap)
+      }
+      return null
+    } catch (e: Exception) {
+      Log.e("Talsec", "Could not retrieve app icon for ${packageName}: ${e.message}")
+      return null
+    }
+  }
+
+  /**
+   * Retrieves installation source for the given package name
+   * @param context React Native context
+   * @param packageName package name for which installation source should be retrieved
+   * @return Installation source package name
+   */
+  @Suppress("DEPRECATION")
+  internal fun getInstallationSource(context: ReactContext, packageName: String): String? {
+    return try {
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+        context.packageManager.getInstallSourceInfo(packageName).installingPackageName
+      } else {
+        context.packageManager.getInstallerPackageName(packageName)
+      }
+    } catch (e: Exception) {
+      Log.e("Talsec", "Could not retrieve app installation source for ${packageName}: ${e.message}")
+      null
+    }
+  }
+}