Back to results for “Android”
Flutter › Flutter App Security Best Practices

How should a Flutter app properly detect whether it is currently running on a rooted Android device or a jailbroken iOS device, and what genuine security risks does running on such a compromised device actually introduce?

Advanced

Answer

A rooted Android device or a jailbroken iOS device has effectively had its normal, standard operating system level security restrictions deliberately removed or bypassed by its owner, which means a malicious app running on that exact same compromised device could potentially gain unauthorized access to another app's own private data or actively tamper with that other app's genuine runtime behavior in ways that would simply not otherwise be possible on a properly secured, unmodified device, and specialized detection packages can help a genuinely security sensitive app, such as one handling real financial transactions, detect this specific compromised state and appropriately respond, such as by restricting certain particularly sensitive features or clearly warning the user about the increased inherent risk.
final isJailbroken = await FlutterJailbreakDetection.jailbroken;
if (isJailbroken) {
  showSecurityWarning();
}
Real-world example A cryptocurrency wallet app detects that it is currently running on a rooted Android device and responds by restricting certain particularly sensitive wallet operations while clearly warning the user about the meaningfully increased security risk of continuing to use the app on that specific compromised device.

Common follow-ups: Can root or jailbreak detection ever actually be fully completely reliable against a sufficiently determined attacker?;What is a reasonable, proportionate response for an app to actually take once it has genuinely detected a compromised device?