Skip to content

Security: abdelrahmanbonna/security_plus

SECURITY.md

Security Policy

Security Features and Updates

Version 3.1.0 (Latest)

  • Bug Fixes
    • Fixed android 16kb non-complanice parts.
    • upgrading permission handler
    • upgrading lints

Anti-Tampering Protection

Root Detection Mechanisms

  1. RootBeer Integration

    • Base root detection using RootBeer library
    • Custom enhancements for deeper system checks
    • Verification of system partition integrity
  2. Frida Protection

    • Active process monitoring for Frida-related services
    • Detection of Frida libraries and injections
    • Runtime protection against Frida hooks
    • Process memory scanning for suspicious patterns
  3. File System Security

    • Scanning for root-related files and directories
    • Detection of modified system binaries
    • Verification of system partition integrity
    • Monitoring of suspicious file permissions
  4. Package Analysis

    • Detection of known root management apps
    • Scanning for superuser applications
    • Identification of common root cloaking tools
    • Package signature verification
  5. Runtime Integrity

    • Hook detection in runtime environment
    • System property verification
    • Native library validation
    • Memory tampering detection

Additional Security Features

  1. Emulator Detection

    • Hardware characteristics analysis
    • Build properties verification
    • System image detection
    • Performance metrics analysis
  2. Development Mode Detection

    • USB debugging status monitoring
    • Developer options verification
    • ADB status checking
    • System settings analysis
  3. Location Security

    • Mock location detection
    • GPS spoofing prevention
    • Location provider verification
    • Coordinate validation
    • Runtime permission handling
  4. Storage Security

    • External storage monitoring
    • App installation location verification
    • Storage permission analysis
    • File system integrity checks

Security Best Practices

Implementation Guidelines

  1. Permission Management

    // Always check permissions before security checks
    if (Platform.isAndroid) {
      final locationStatus = await Permission.location.request();
      if (!locationStatus.isGranted) {
        // Handle permission denied case appropriately
        return;
      }
    }
  2. Error Handling

    try {
      final isSecure = await SecurityPlus.isRooted;
      if (isSecure) {
        // Implement appropriate security response
        await handleSecurityBreach();
      }
    } catch (e) {
      // Always handle exceptions gracefully
      await logSecurityException(e);
    }
  3. Multiple Verification Layers

    • Combine multiple security checks
    • Implement time-based verification
    • Use progressive security responses
    • Maintain security logs
  4. Response Strategies

    • App termination for critical breaches
    • Feature limitation for suspicious activity
    • User notification for security concerns
    • Secure data wiping when necessary

Required Permissions

Android

<manifest>
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
</manifest>

iOS

<key>NSLocationWhenInUseUsageDescription</key>
<string>Required for security verification</string>

Vulnerability Reporting

Please report security vulnerabilities by opening an issue in the repository. We take all security issues seriously and will respond promptly.

Please include the following information in your report:

  • Type of issue
  • Full paths of source file(s) related to the manifestation of the issue
  • Location of source file(s) in question (tag/branch/commit or direct URL)
  • Step-by-step instructions to reproduce the issue
  • Proof-of-concept or exploit code (if possible)
  • Impact of the issue, including how an attacker might exploit it

Response Process

  1. Initial Response: Within 24 hours
  2. Issue Confirmation: Within 72 hours
  3. Fix Implementation: Timeline varies based on severity
  4. Public Disclosure: After fix validation and deployment

Version Support

Version Supported Notes
3.0.x Current version with enhanced security
2.0.x Legacy support
< 2.0 Deprecated

Security Updates

We regularly update our security measures to address new threats and vulnerabilities. Stay updated with the latest version to ensure maximum security.

There aren’t any published security advisories