public final class ShieldSignal
- Object
- ShieldSignal
One runtime self-protection observation, such as “a hooking framework is loaded”.
Signals are reports, not verdicts. The device never decides it is compromised and never terminates itself over one of these; it reports what it saw and the attestation service decides whether to keep issuing tokens. That ordering matters for two reasons: a hard local exit is trivially patched out of the binary, and it destroys the telemetry that would have told the developer an attack was happening at all.
Fields
public static final String ROOT = "root" | A rooted Android device. |
public static final String JAILBREAK = "jailbreak" | A jailbroken iOS device. |
public static final String HOOK = "hook" | A dynamic instrumentation or hooking framework is present. |
public static final String EMULATOR = "emulator" | The app is running on an emulator or simulator. |
public static final String DEBUGGER = "debugger" | A debugger is attached to the process. |
public static final String REPACKAGED = "repackaged" | The app’s signing certificate does not match the one it was built with. |
public static final String ACCESSIBILITY = "accessibility" | An accessibility service that is not on the allow list is enabled. |
public static final String TAPJACK = "tapjack" | Another application’s window was drawn over this app while it was being touched, which is how a tapjacking attack presents itself. |
Constructors
public ShieldSignal(String id, int severity, String detail) |
Methods
public String getId() | A stable identifier such as HOOK. |
public int getSeverity() | How strongly this points at an attack, 0 to 100. |
public String getDetail() | What was actually observed, for example the offending package or library name. |
public long getTimestamp() | When the observation was made. |
public String toString() | Returns a string representation of the object. |
Inherited methods
Field details
ROOT
public static final String ROOT = "root"A rooted Android device.
JAILBREAK
public static final String JAILBREAK = "jailbreak"A jailbroken iOS device.
HOOK
public static final String HOOK = "hook"A dynamic instrumentation or hooking framework is present.
EMULATOR
public static final String EMULATOR = "emulator"The app is running on an emulator or simulator.
DEBUGGER
public static final String DEBUGGER = "debugger"A debugger is attached to the process.
REPACKAGED
public static final String REPACKAGED = "repackaged"The app’s signing certificate does not match the one it was built with.
ACCESSIBILITY
public static final String ACCESSIBILITY = "accessibility"An accessibility service that is not on the allow list is enabled.
TAPJACK
public static final String TAPJACK = "tapjack"Another application’s window was drawn over this app while it was being touched, which is
how a tapjacking attack presents itself. Unlike the signals above this describes a moment
rather than a property of the device: see
DeviceIntegrity.isScreenObscured().Constructor details
ShieldSignal
public ShieldSignal(String id, int severity, String detail)Method details
getId
public String getId()A stable identifier such as
HOOK. Engines may report ids this build predates.getSeverity
public int getSeverity()How strongly this points at an attack, 0 to 100. Advisory only – the service applies the
policy, so a low severity here does not mean the service will ignore it.
getDetail
public String getDetail()What was actually observed, for example the offending package or library name. May be null.
getTimestamp
public long getTimestamp()When the observation was made.
toString
public String toString()Returns a string representation of the object. In general, the toString method returns a string that “textually represents” this object. The result should be a concise but informative representation that is easy for a person to read. It is recommended that all subclasses override this method.
The toString method for class Object returns a string consisting of the name of the class of which the object is an instance, the at-sign character `@’, and the unsigned hexadecimal representation of the hash code of the object. In other words, this method returns a string equal to the value of:
getClass().getName() + ‘@’ + Integer.toHexString(hashCode())