diff --git a/CHANGELOG.md b/CHANGELOG.md index 6240093..a74ac9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,13 @@ +# freeRASP 6.0.0 +We are constantly working on improving your freeRASP experience. This update contains a new check - obfuscation detection. Minimal supported Android SDK level was raised to 23. + +## What's new in 6.0.0? +- ❗ BREAKING: Raised minSdkVersion on Android to 23 +- ❗ Removed BouncyCastle dependency on Android +- 🔎 New threat type `obfuscationIssues` +- 🔎 New threat callback `onObfuscationIssues` +- ✔️ Fixed `NullPointerException` which could occur during specific subcheck execution on Android + # freeRASP 5.0.4 - ✔️ Fixed issue with metadata in iOS framework diff --git a/README.md b/README.md index 03127f8..fbc7c70 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ Add dependency to your `pubspec.yaml` file ```yaml dependencies: - freerasp: 5.0.4 + freerasp: 6.0.0 ``` and run `pub get` @@ -100,14 +100,14 @@ and integration script from your project: ### Android setup * From root of your project, go to **android > app > build.gradle** -* In `defaultConfig` update `minSdkVersion` to at least **21** (Android 5.0) or higher +* In `defaultConfig` update `minSdkVersion` to at least **23** (Android 6.0) or higher ```gradle android { ... defaultConfig { ... - minSdkVersion 21 + minSdkVersion 23 ... } ... @@ -213,6 +213,7 @@ void main() { // Setting up callbacks final callback = ThreatCallback( onAppIntegrity: () => print("App integrity"), + onObfuscationIssues: () => print("Obfuscation issues"), onDebug: () => print("Debugging"), onDeviceBinding: () => print("Device binding"), onDeviceID: () => print("Device ID"), @@ -247,28 +248,25 @@ void main() async { ``` ## Step 5: Additional note about obfuscation -The freeRASP contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also partially randomized for each application so it cannot be automatically abused by generic hooking scripts. +The freeRASP contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. -### Android -The majority of Android projects support code shrinking and obfuscation without any additional need for setup. The owner of the project can define the set of rules that are usually automatically used when the application is built in the release mode. For more information, please visit the official documentation -* https://developer.android.com/studio/build/shrink-code -* https://www.guardsquare.com/manual/configuration/usage +In order to provide as much protection as possible, freeRASP enhances security measures by implementing ProGuard consumer rules, which obfuscate specific sections of the SDK. **However, these rules are applied to your Android app code as well due to inheritance.** -You can make sure, that the obfuscation is enabled by checking the value of **minifyEnabled** property in your **module's build.gradle** file. -```gradle -android { - ... +Finally, if there is a problem with the obfuscation freeRASP will notify you about it via **obfuscationIssues** callback. - buildTypes { - release { - minifyEnabled true - shrinkResources true - proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro' - } - } -} +In certain cases, you may prefer to exclude this rule. + +To remove the rule, you need to find `freerasp` in your cache folder. More about where to find the cache folder [here](https://dart.dev/tools/pub/environment-variables). Then navigate to the freerasp-X.Y.Z/android/build.gradle file and delete the line: + +```groovy +consumerProguardFiles 'consumer-rules.pro' ``` +You can read more about Android obfuscation in the official documentation: +- https://developer.android.com/studio/build/shrink-code +- https://www.guardsquare.com/manual/configuration/usage + + ## Step 6: User Data Policies See the generic info about freeRASP data collection [here](https://github.com/talsec/Free-RASP-Community/tree/master#data-collection-processing-and-gdpr-compliance). @@ -380,16 +378,16 @@ freeRASP is freemium software i.e. there is a Fair Usage Policy (FUP) that impos Runtime App Self Protection (RASP, app shielding) - Advanced root/jailbreak protections + Advanced root/jailbreak protections (including Magisk) basic advanced Runtime reverse engineering controls basic @@ -398,7 +396,7 @@ freeRASP is freemium software i.e. there is a Fair Usage Policy (FUP) that impos Runtime integrity controls