Threat-Events™, In-App Threat Intelligence in Native Android Apps

This knowledge base article shows you how easy it is to use Appdome Threat-Events™ to get in-app threat intelligence in native Android apps and control the user experience in your native Android apps when mobile attacks occur.

To enable Threat-Events with any runtime protection, select the check box next to Threat-Events for that feature. Doing so will enable (turn ON) Threat-Events for that feature. To enable Threat-Scores for any runtime protection, click the up/down arrow associated with Threat-Scores to assign a specific score to each protection.
Threat-Scores must have a value greater than zero (0) and less than a thousand (1,000).

Threat-Events and Threat-Scores can be used with or in place of server-based mobile anti-fraud solutions.

Prerequisites for Using Threat-Events with Native Android Apps

Here’s what you need to use Threat-Events with native Android apps:

• Appdome account (If you do not yet have an account, create a free Appdome account).
• Appdome account class – Appdome DEV or higher.
• Mobile Application Source Code.
• Signing Credentials (e.g., signing certificates and provisioning profile) – see Signing Secure Android apps.

Code Snippet Required for Using Threat-Events with Native Android Apps

Before consuming Threat-Events or Threat-Scores in your Native Apps, confirm that the following conditions are met:

• Threat-Events and/or Threat-Scores have been enabled ( turned ON) for the specific protection
• You are using the correct identifiers for the Threat-Events for each protection.
  You can find the specific identifiers for each Threat-Event and Threat-Score in the knowledge base article associated with each protection.

Below is the code snippet required for using Threat-Events™ and Threat-Scores™ in Native Android Apps:

private BroadcastReceiver receiver;
private Context context;
// Explicitly state that the ThreatEvents BroadcastReceiver should not be exported
private void registerReceiverWithFlags(IntentFilter intentFilter) {
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
        context.registerReceiver(receiver, intentFilter, Context.RECEIVER_NOT_EXPORTED);
    } else {
        context.registerReceiver(receiver, intentFilter);
    }
}
public void init(Context context) {
    this.context = context;
    receiver = new BroadcastReceiver() {
        @Override
        public void onReceive(Context context, Intent intent) {
            onEvent(intent);
        }
    };
    registerReceiverWithFlags(new IntentFilter("RootedDevice"));
}
// This method should be called during the Activity.onPause() if the context used when calling the init() method is an Activity context
public void stop() {
    context.unregisterReceiver(receiver);
}
private void onEvent(Intent intent) {
    String action = intent.getAction();
    switch (action) {
        case "RootedDevice":
            String defaultMessage = intent.getStringExtra("defaultMessage");
            String internalError = intent.getStringExtra("internalError");
            String timeStamp = intent.getStringExtra("timestamp");
            String deviceID = intent.getStringExtra("deviceID");
            String deviceModel = intent.getStringExtra("deviceModel");
            String osVersion = intent.getStringExtra("osVersion");
            String kernelInfo = intent.getStringExtra("kernelInfo");
            String deviceManufacturer = intent.getStringExtra("deviceManufacturer");
            String fusedAppToken = intent.getStringExtra("fusedAppToken");
            String carrierPlmn = intent.getStringExtra("carrierPlmn");
            String deviceBrand = intent.getStringExtra("deviceBrand");
            String deviceBoard = intent.getStringExtra("deviceBoard");
            String buildHost = intent.getStringExtra("buildHost");
            String buildUser = intent.getStringExtra("buildUser");
            String sdkVersion = intent.getStringExtra("sdkVersion");
            //
            // Respond to mobile app attacks and threats here
            //
            break;
        // Add cases for other actions here...
        default:
            Log.e("Appdome ThreatEvent", "unknown event received " + action);
            break;
    }; 
}

Threat-Event Failsafe Enforcement

Failsafe Enforcement provides app developers with the ability to manage when Appdome enforces specific detections. To utilize this feature, follow the steps below:

1. Set the Threat Event of the selected feature to “In-App Detection” mode.
2. Enable the Threat-Event Failsafe Enforcement option.

Once you have received the Threat Event and performed the necessary internal logic, you should post a notification named “EnforceThreatEvent” using Android’s Broadcast API with the userInfo received from the Threat Event. Below is the code snippet required for using Threat Event in Failsafe Enforcement configuration, with the RootedDevice event as an example:

String action = intent.getAction();
switch (action) {
    case ROOTED_DEVICE: // // Respond to mobile app attacks and threats here, as seen above // // Notify Appdome to enforce the Threat Event after Threat Event is handled Intent newIntent = new Intent("EnforceThreatEvent"); newIntent.putExtras(intent.getExtras()); newIntent.setPackage(context.getPackageName()); context.sendBroadcast(newIntent); }

To learn more, please read Threat-Events in Android & iOS Apps Explained

Special Considerations for Using Threat-Events with Native Android Apps

None.

Compatibility with Android 14

Following a security update introduced in Android 14 (API level 34), apps targeting Android 14 are required to explicitly specify whether a registered receiver should be exported to all other apps on the device. A SecurityException will be raised if a context-registered broadcast receiver is registered without passing either Context.RECEIVER_NOT_EXPORTED or Context.RECEIVER_EXPORTED. The receiver flags were introduced in Android 13 as part of  “Safer exporting of context-registered receivers”, as seen here: [https://developer.android.com/about/versions/13/features#runtime-receivers]. Therefore when registering a broadcast receiver for Threat Events, the call to register a a context-registered  BroadcastReceiver registration should include the Context.RECEIVER_NOT_EXPORTED receiver flag when the app targeting Android 13 and above in order to ensure that the receiver will only accept broadcasts sent from within the protected app. For additional details, please follow this Android guide: [https://developer.android.com/guide/components/broadcasts#context-registered-receivers]

Meta-Data for Mobile Application Threat-Events and Threat-Scores

Below is the list of metadata that can be associated with each mobile application Threat-Event and Threat-Score in native Android apps.

Some or all of the meta-data for each mobile application Threat-Event and Threat-Score can be consumed in Native Android Apps at the discretion of the mobile developer and used, in combination with other mobile application data, to adapt the business logic or user experience when one or more attacks or threats are present.

Using Conditional Enforcement for Mobile Application Threat-Events and Threat-Scores

Conditional Enforcement is an extension to Appdome’s mobile application Threat-Event framework. By using conditional enforcement, developers can control when Appdome enforcement of each mobile application protection takes place or invoke backup, failsafe, and enforcement to any in-app enforcement used by the mobile developer.

Verifying Threat Events in Native Android Apps

After you have implemented the required Threat-Event code in your native Android apps, you can confirm that your Threat-Event implementation(s) is properly recognized by the Appdome protections in the native Android apps. To do that, review the Certified Secure™ DevSecOps certificate for your build on Appdome.

In the Certified Secure DevSecOps certificate, the correct implementation of Threat-Events in your mobile application is seen below.

In the Certified Secure DevSecOps certificate, an incorrect implementation of Threat-Events in your mobile application looks as seen below.

For information on how to view and/or retrieve the Certified Secure DevSecOps certification for your mobile application on Appdome, please visit the knowledge base article Using Certified Secure™ Android & iOS Apps Build Certification in DevOps CI/CD.