# Android AppSealing
Android AppSealing provides a wide range of security measures. Among them, we have patented technology that allows us to protect your apps's memory and code from being hacked and stolen. The sealing will add the security module to your app. Then, the security module in the sealed app will launch along with the game to protect it.
For Android AppSealing (console) :
- Open the ADC console at https://console.appsealing.com (opens new window)
- Login with appsealing account credentials
- In the navigation pane, choose 'Android AppSealing'
- Apply AppSealing
- Historical Information
- App Configurations
- Manage KeyStore
# Apply AppSealing
AppSealing provides self-protection features like code protection, integrity protection, rooting detection, cheat tool and emulator detection without ANY CODING.
Things you should aware before starting with AppSealing
- Platform - App Platform on which application is built, which can be iOS or Android
- Framework - Framework use to build app, In case of hybrid frameworks like react you should know which react version was used for development
- KeyStore Info - Once app is sealed and ready to release in playstore, you can either sign sealed app by yourself or can use AppSealing to sign it which requires keystore information
# Sealing App
Applying AppSealing mobile app security takes only 3 steps
- Configure sealing options at ADC or using CLI tool. Based on features sealing options are divided into multiple sections like mandate fields, general features and advanced features
- Upload your app and apply AppSealing. You can either upload android app as apk file or aab file. AppSealing also provide feature to secure JS files for React Framework where you can upload zip files.
- Download signed app with keystore configuration or un-signed app via apksigner
Sealing options provide customization to security applicable while sealing app, they are segregated as below:
- Mandatory fields consist of set of fields related to application like app framework, category, framework version etc. Details are mentioned in metrics mandatory fields section.
- General Features contains security options that can be enabled or disabled based on your requirement. To ensure complete security block all the features to restrict vulnerabilities, more details for options are provided in metrics general features.
- AppSealing provides advanced set of functionalities that can protect not only application but also data used by App like Data Sealing or Custom Blacklist. Navigate to advanced features for more information.
Based on the sealing options user can view the security level on right top section. This gets updated based on the AppSealing Version and Sealing options. Once the sealing options are configured user can upload application by drag-drop or selecting upload button and click on "Apply AppSealing" to start sealing. Sealing will start securing your application and will prompt download using window, you can also download sealed apps later from Historical Information.
# Mandatory Fields:
|App framework||Application framework is platform used to develop your android application. AppSealing supports native as well as hybrid frameworks. Select the appropriate option for your app by choosing option from drop-down|
|AppSealing Version||Details related to sealing versions to be applied on application, use the latest version to access latest security features along with newer framework versions|
# General Features:
|Dex Encryption : |
Protects JAVA code from tampering by encrypting multiple Dex files. Activating this option may slightly increases app's initial (after install or update) loading time
|Rooting : |
Determine whether your app can run on rooted smartphones
|Emulators : |
Set whether your app can run on Android emulators. If you choose to allow emulators, note that until further notice, AppSealing only guarantees protection for BlueStacks and Nox
|Work Profile & Samsung Security Folder : |
In the work profile environment, AppSealing's security features can be disabled. Also, we found some cheating tools are using work profiles to attack devices and apps
|Macro Tools : |
Macro tools can be used for purposes other than abusing app. Blacklists are always up to date to block macro tools
|Packet Attacks : |
Packet attack tools collect data transferred through the network
|Keylogger : |
A keylogger is a monitoring tool which hides on the device and collects user's touch information
|Mirroring app : |
A mirroring app is a utility tool which can share device's screen to other devices
|Remote access app : |
A remote access app is a utility tool which allow other device to access the device and can control it remotely
|Launch by External App : |
You can block app launch when hacker execute your app from hacking tool to analyze and attack your app. If your app requires launcher app, then please select 'Allow'
|Data Sealing : |
DataSealing provides a function that securely encrypts and stores binary file data without additional coding, and allows you to directly read and use the encrypted data, currently supported only for Android Native C/C++ (NDK)
|Custom Blacklist : |
The custom blacklist is the first feature of Android AppSealing's Over-the-Air update service. App administrators can block suspicious apps that are not blocked by AppSealing's default blacklist
# Security Guide
- Before AppSealing
Firebase Crashlytics should maintain their original package name without obfuscate to be supported by AppSealing.
Below class must not be obfuscated to check React Native version
- After AppSealing
Certificates in the apk is disabled, so you must re-sign your apk with apksigner to install it on your devices
To upload your appbundle on PlayStore, appbundle should be signed by jarsigner.
220.127.116.11 version can support React Native version as below:
- Hermes engine: 0.61+
# Historical Information
Historical information tab contains sealing history details for past 30 days. Using this information user can view own as well as team members sealed app configurations. Depending on the status of sealing user can download successful sealed apps or view errors from unsuccessful apps.
Table data is auto fetched at interval of 1mins, but user can also reload data using refresh icon. You can drill down the result set by specifying filters using search bar. This result set contains useful information such as following:
- Time on which threats are reported
- Type of application (Native / Hybrid)
- Android package name
- User Name who sealed application
- App Category (Game / Non-Game)
- AppSealing version
- AppSealing Status(In-Progress / Completed / Failed)
- Download where user can download successfully sealed app (more details)
- View Errors where user can see errors caused while sealing app
Each record will provide all configurations set while sealing app. To view this details select record and click on '+' icon in first column
# Downloading Sealed Application
When android app is sealed successfully you will get prompt message to download it. This action is exactly similar to download sealed app from historical information. Sealed app can be downloaded in following ways:
- Download without signing
Applying AppSealing disable your apk's signature. You can download unsigned apk file. Unsigned apk file won't be installed in smartphone.You should sign apk file with your key to install and run the app for test and release
- Download signed app with AppSealing key
You can download signed apk file with AppSealing's key to install and run a test on your smartphone. Signing app with different key will disable authentication related functions such as Google login
- Download signed app with your key
You can register your own key and download the sealed & signed apk. Keystore & key information is encrypted and only used for signing your app
# App Configurations
App Configurations helps to manage your application services. For android apps you can toggle services, manage dex-list, toggle advanced features like data sealing and custom blacklist, etc.
App Configurations displays list of sealed applications by user or team members in card layout. On initial load it will displays 20 apps and further apps can be fetched by clicking "more details" button. Use search bar on top section to filter the apps based on app or package name. Following configurations are available for each application to users:
If enabled appsealing will track all hacking information for application. This will incur the charges on usage basis, so if not using app or want to stop using AppSealing do turn off the service for respective app here
- Data Sealing
Data Sealing is used to secure your application Data files. It is currently available for Professional users with additional cost and free of cost for Enterprise users. If not using turn off 'Data Sealing' service to avoid incurring additional costs. See how to apply data sealing for more details
- Custom Blacklist
The Custom Blacklist is the first feature of Android AppSealing's Over-the-Air update service. App administrators can block suspicious apps that are not blocked by AppSealing's default blacklist. Currently, the OTA update service is not available in Trial or Professional Plans and can be activated through separate consultations and Enterprise contracts. If you contact the AppSealing business team or the help center, we will provide you with more details. In order to use the custom blacklist, the OTA update service must be activated first. See how to apply custom blacklist for more details
- Manage Selection
Using Manage selection user can update the selective dex. Selective Dex encryption is a feature that encrypts and protects specific dex files built with Java/Kotlin code on Android apps to mitigate any degradation in performance on some apps when all dex files are encrypted. When the app is installed on the device, the dex file is optimized for the device by its system, but the system cannot optimize the dex file encrypted by applying app sealing. See how to apply manage selection for more details
- Transfer Account
You can transfer you sealed application to any account associated with AppSealing. This feature is useful when you using test account for POC's, transfer apps to team members within your organization, etc. See how to transfer account for more details
# Manage KeyStore
App developed in android or sealed app cannot be installed on mobile devices unless it is signed with keystore information. Previously user needs to download sealed apk and then sign it manually. ADC provides functionality to download signed apk which can directly installed on devices for testing or launch to external users as well. To achieve this user can maintain keystore information in Manage KeyStore tab.
To register keystore following things are required:
- KeyStore Password
- Alias Password
- KeyStore File
Fill all the above information and click on update to save the info. Once it is saved user can download sealed apk and choose "Download signed app with your key" option to download pre-signed app with saved key. You can also delete the keys if not required later as well.