Malware Detection Configuration Malware detection is an integral part of the freeRASP SDK and is configured using the same TalsecConfig object. Malware configuration in TalsecConfig allows you to customize the behavior of the malware detection feature.
To enable malware detection, extend the configuration used during the initial integration of the SDK:
Android
Copy // Android uses Builder pattern for configuration
TalsecConfig config = new TalsecConfig . Builder ( context . getPackageName () , new String [] {CERTIFICATE_HASH})
. blacklistedPackageNames ( new String []{ "com.blocked.app" })
. blacklistedHashes ( new String []{ "blockedHash" })
. suspiciousPermissions ( new String [][]{{ "android.permission.READ_CONTACTS" } , { "android.permission.SEND_SMS" }})
. whitelistedInstallationSources ( new String []{ "com.android.vending" })
. build (); Flutter
Copy // Flutter uses nested malware configuration object (malwareConfig)
final config = TalsecConfig (
androidConfig : AndroidConfig (
/* other config parameters */
// Malware Detection configuration object
malwareConfig : MalwareConfig (
blacklistedPackageNames : [ 'com.example.app' ],
blacklistedHashes : [ 'blockedHash' ],
suspiciousPermissions : [
[ 'android.permission.CAMERA' ],
[ 'android.permission.READ_SMS' , 'android.permission.READ_CONTACTS' ],
],
whitelistedInstallationSources : [ 'com.android.vending' ],
),
),
iosConfig : IOSConfig ( /* other config parameters */ ),
watcherMail : 'your_mail@example.com' ,
isProd : true ,
); React Native
Copy // React Native uses nested malware configuration object (malwareConfig)
const config = {
androidConfig : {
...
malwareConfig: {
blacklistedHashes : [ 'FgvSehLMM91E7lX/Zqp3u4jMmd0A7hH/Iqozu0TMVd0u' ] ,
blacklistedPackageNames : [ 'com.wultra.app.screenlogger' ] ,
suspiciousPermissions : [
[ 'android.permission.BLUETOOTH' , 'android.permission.INTERNET' ] ,
[ 'android.permission.BATTERY_STATS' ] ,
] ,
whitelistedInstallationSources : [ 'com.apkpure.aegon' ] ,
} ,
}
} Cordova
Copy // Cordova uses nested malware configuration object (malwareConfig)
const config = {
androidConfig : {
...
malwareConfig: {
blacklistedHashes : [ 'FgvSehLMM91E7lX/Zqp3u4jMmd0A7hH/Iqozu0TMVd0u' ] ,
blacklistedPackageNames : [ 'com.wultra.app.screenlogger' ] ,
suspiciousPermissions : [
[ 'android.permission.BLUETOOTH' , 'android.permission.INTERNET' ] ,
[ 'android.permission.BATTERY_STATS' ] ,
] ,
whitelistedInstallationSources : [ 'com.apkpure.aegon' ] ,
} ,
}
} Capacitor
Copy // Capacitor uses nested malware configuration object (malwareConfig)
const config = {
androidConfig : {
...
malwareConfig: {
blacklistedHashes : [ 'FgvSehLMM91E7lX/Zqp3u4jMmd0A7hH/Iqozu0TMVd0u' ] ,
blacklistedPackageNames : [ 'com.wultra.app.screenlogger' ] ,
suspiciousPermissions : [
[ 'android.permission.BLUETOOTH' , 'android.permission.INTERNET' ] ,
[ 'android.permission.BATTERY_STATS' ] ,
] ,
whitelistedInstallationSources : [ 'com.apkpure.aegon' ] ,
} ,
}
} It includes the following fields:
blacklistedPackageNames
A list of package names , any app with a package name in this list will trigger a detection.
blacklistedHashes
A list of APK hashes, which will trigger a detection. These hashes typically represent known malicious app versions.
suspiciousPermissions