Bypassing root detection using brutdroid.

[nikhil-macherla23]

Hi, We have a Mobile application developed with react-native + expo (We are using webview). We have implemented root detection using this jail-monkey library to prevent users to run the app on rooted devices. However, our users are able to bypass root detection and they are able to run the our app on rooted devices in their pentesting by using tools like Frida, Brutdroid, Magisk etc. Can we have any other ways to prevent root detection bypass in their pentesting? Please let me know if there any solutions

[Rananjaya]

Hi @nikhil-macherla23,

We have faced a similar challenge in our applications. Based on our experience, jail-monkey alone can be bypassed because it operates through the React Native/JavaScript layer, where attackers may be able to hook or modify behavior at runtime.

What worked better for us was implementing additional security controls in native Android (Kotlin/Java) and iOS (Swift/Objective-C) code, including root/jailbreak detection, integrity checks, and anti-tampering measures. Using multiple layers of protection is generally more effective than relying on a single detection mechanism.

We also found it helpful to perform critical checks as early as possible during application startup, before loading the main application logic.

It's important to note that no client-side protection is completely bypass-proof. The goal is to increase the effort required to bypass the protections by combining multiple security controls.

For additional guidance, you may find the OWASP Mobile Application Security Verification Standard (MASVS) helpful:
https://mas.owasp.org/MASVS/

Hope this helps.