# Introduction

freeRASP is a lightweight and easy-to-integrate mobile security library designed to detect potential threats during the application's runtime. It contains multiple security checks, each aimed to cover possible attack vectors to ensure a high level of application security.

<figure><img src="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FI3n8ibRczTAKQuRNhxis%2FFreeRasp.png?alt=media&#x26;token=2a9e57e7-c312-4fb2-974f-180be9f19edd" alt=""><figcaption></figcaption></figure>

## What does freeRASP do?

freeRASP provides detection of potentially dangerous behaviour, including the following:

* Using [rooted or jailbroken](#user-content-fn-1)[^1] devices (e.g., su, Magisk, unc0ver, check1rain, Dopamine).
* Reverse engineering attempts.
* Running [hooking frameworks](#user-content-fn-2)[^2] (e.g., Frida, Xposed or Shadow).
* [Tampering or repackaging](#user-content-fn-3)[^3] the application.
* Installing the app through [untrusted methods/unofficial stores](#user-content-fn-4)[^4].
* Running the app in various emulators[^5].
* Detect fake clones and multiinstancing[^6] (Parallel Space)
* [Screenshot and screen recording](#user-content-fn-7)[^7] attempts.

## Advantages

* Reactions to various attacks and detected security threats via an API (callback mechanism).
* Simple integration.
* VPN[^8] detection.
* ADB[^9], [Developer Mode](#user-content-fn-10)[^10], USB debugging detections.
* No significant effect on the app performance.
* Data visualization [Talsec Portal](https://docs.talsec.app/freerasp/freerasp/data-visualisation-portal) with real-time security insights, global benchmarks, and detailed analytics
* Weekly security report via email indicating the security status of devices and app integrity.
* Fulfills [OWASP MASVS-RESILIENCE](https://mas.owasp.org/checklists/MASVS-RESILIENCE/) requirements.

{% hint style="info" %}
Top apps rely on Talsec SDKs—see them [**here**](https://42matters.com/sdk-analysis/top-security-and-privacy-sdks#talsec).
{% endhint %}

## Limitations

* Limits of [Fair Usage Policy](https://docs.talsec.app/freerasp/terms-of-service/fair-usage-policy-fup) (free up to 100k devices).
* Data collection from your app to Talsec DB.
* Security protections:
  * basic protection against root/jailbreak (including Magisk, Dopamine),
  * basic runtime reverse engineering controls,
  * basic runtime integrity controls.
* No [overlay and accessibility services misuse](#user-content-fn-11)[^11] protection.

{% hint style="info" %}
Learn more about the limitations of freeRASP [**here**](https://docs.talsec.app/freerasp/features-and-pricing-plans#plans-comparison).
{% endhint %}

## Talsec Portal

Access real-time security insights, global benchmarks, and detailed analytics!&#x20;

* 📊 **Real-Time Threat Monitoring:** Gain insights into threat counts, types, and occurrences over time.
* 📈 **Global Benchmarking:** Benchmark your app's security against global statistics.
* 📚 **Stay informed:** Read the latest articles and documentation on app security best practices.

{% hint style="info" %}
Learn more about the Talsec Portal [**here**](https://docs.talsec.app/freerasp/freerasp/data-visualisation-portal).
{% endhint %}

## Workflow scheme

<figure><img src="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FU1V9greYISfKr838T30j%2FFrame%202147223711%20(2).png?alt=media&#x26;token=5c4e9507-29b3-4980-868b-ef433c21c9ec" alt=""><figcaption></figcaption></figure>

## Supported platforms

freeRASP is currently supported for:

* [Android](https://docs.talsec.app/freerasp/freerasp/integration/android)
* [iOS](https://docs.talsec.app/freerasp/freerasp/integration/ios)
* [Flutter](https://docs.talsec.app/freerasp/freerasp/integration/flutter)
* [React Native](https://docs.talsec.app/freerasp/freerasp/integration/react-native)
* [Cordova](https://docs.talsec.app/freerasp/freerasp/integration/cordova)
* [Capacitor](https://docs.talsec.app/freerasp/freerasp/integration/capacitor)
* [Kotlin Multiplatform](https://docs.talsec.app/freerasp/freerasp/integration/kotlin-multiplatform)
* [Unity](https://docs.talsec.app/freerasp/freerasp/integration/unity)
* [Unreal Engine](https://docs.talsec.app/freerasp/freerasp/integration/unreal-engine)

#### freeRASP is currently tested and compatible with

* 🤖 Android smartphones, tablets, emulators, Android TVs
* 🍎 iPhones, iPads, simulators

## Discover freeRASP

<table data-view="cards" data-full-width="false"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="files"></th></tr></thead><tbody><tr><td><strong>Integration</strong></td><td>Integrate freeRASP for your platform</td><td><a href="integration">integration</a></td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2F5d2XRCK2yaFZa1jfJTmy%2FFrame%202147223637%20(8).svg?alt=media&#x26;token=a27d78b3-81ad-4360-8df7-8412105a045e">Frame 2147223637 (8).svg</a></td></tr><tr><td><strong>Security Reports</strong></td><td>Learn about regular security reports</td><td><a href="data-visualisation-portal">data-visualisation-portal</a></td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FeExzP8pxOcyNTZXsylbk%2FFrame%202147223637%20(9).svg?alt=media&#x26;token=b8992828-67a4-4501-a453-476e6f3a141f">Frame 2147223637 (9).svg</a></td></tr><tr><td><strong>License</strong></td><td>How is freeRASP licensed</td><td><a href="../terms-of-service/license">license</a></td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2F9L0tWjw0MnGkCa42bcO4%2FFrame%202147223638%20(2).svg?alt=media&#x26;token=296c4218-c9c3-4767-97dd-9f8c8a3bd00a">Frame 2147223638 (2).svg</a></td></tr></tbody></table>

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Commercial Subscriptions</strong></td><td>Get maximum protection for your app</td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FFVzeWmCmz63pb9Tx0MXH%2FFrame%202147223637%20(7).svg?alt=media&#x26;token=a3b2b8f9-fd66-4619-a49d-b8871aeb8b59">Frame 2147223637 (7).svg</a></td><td><a href="features-and-pricing-plans">features-and-pricing-plans</a></td></tr><tr><td><strong>User Data Policies</strong></td><td>Learn how we process your data</td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FPF6EYHJGmuykPdTW5V9o%2FFrame%202147223637%20(10).svg?alt=media&#x26;token=850d1d01-bb5b-4301-970d-8e53ff16f5a9">Frame 2147223637 (10).svg</a></td><td><a href="../terms-of-service/user-data-policies">user-data-policies</a></td></tr><tr><td><strong>Community [Apply to Join!]</strong></td><td>Space for developer's creativity, community programs</td><td><a href="https://3557356308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ2PxZTOjhquOxcxftTrm%2Fuploads%2FMyMDOPxs39SChnuz4xmS%2Fimage.jfif?alt=media&#x26;token=584b0ba8-5fa1-4217-95b5-0f2d2be5ee67">image.jfif</a></td><td><a href="broken-reference">Broken link</a></td></tr></tbody></table>

[^1]: Rooting/jailbreaking is a technique of acquiring privileged control over the operating system of an Android/iOS device. While most users root their devices to overcome the limitations put on the devices by the manufacturers, it also enables those with malicious intent to abuse privileged access and steal sensitive information. Many different attack vectors require privileged access to be performed. Tools such as [Magisk](https://github.com/topjohnwu/Magisk), [Shamiko](https://github.com/LSPosed/LSPosed.github.io/releases), [Shad0w](https://github.com/jjolano/shadow) or [Dopamine](https://github.com/opa334/Dopamine) can hide privileged access and are often used by attackers.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/detecting-rooted-or-jailbroken-devices>

[^2]: The application can be analysed or modified even though its source code has not been changed, applying a technique known as hooking. This technique can be used to intercept system or application calls and then modify them. An attacker can exploit this by inserting new (often malicious) code or by altering existing one to obtain personal client data. The most well-known hooking frameworks are [Frida](https://frida.re/), [Xposed](https://github.com/LSPosed/LSPosed), or [Cydia Substrate](http://www.cydiasubstrate.com/).\
    \
    Learn more: <https://docs.talsec.app/freerasp/wiki/threat-detection/hook-detection>

[^3]: Every application can be easily modified and then resigned by an attacker. This process is known as application repackaging. There may be many reasons for application repackaging, whether it's adding new code, removing app protections, or bypassing app licensing. A modified/tampered application is often distributed using third-party stores or other side channels.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/app-tampering-detection>

[^4]: Users can share a copy of the application on unofficial stores or various pirate forums. While some users download these copies to avoid paying for the product, they can include unknown and possibly dangerous modifications. Verifying an official installation consequently protects both the users and the owner. This reaction is also triggered, if you install the application through alternative ways like unofficial store or Xcode build.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/detecting-unofficial-installation>

[^5]: Running an application inside an emulator/simulator allows an attacker to hook or trace program execution. For applications running inside an emulator, it is easy to inspect the system's state, reset it to a saved image, or monitor how the app operates. Keep in mind that not every emulator/simulator usage means an ongoing potential threat for the application.\
    \
    Learn more:<https://docs.talsec.app/freerasp/wiki/threat-detection/emulator-detection>

[^6]: Multi-instance refers to the ability to launch multiple instances of the same application—either intentionally (such as through app cloning or multi-user modes) or unintentionally (due to a malicious attack or system bug). Each instance may run in a separate process, which can lead to security, privacy, or data consistency issues—especially in sensitive applications like finance, messaging, or enterprise tools.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/multi-instance-detection-android-devices-only>

[^7]: Screenshot detection identifies when a screenshot is taken on a device. Screenshots can expose sensitive app data, such as user credentials, personal content, or confidential information, leading to privacy and security risks.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/screen-capture>

[^8]: Detecting a running VPN service on mobile devices is critical for security-sensitive applications, as it can indicate potential privacy and security risks. VPNs can obscure the user’s actual IP address and route data through servers potentially under external control, which might interfere with geographical restrictions and bypass network security settings intended to protect data integrity and confidentiality. Such anonymising features could be exploited to mask illicit activities, evade compliance controls, or access services from unauthorised regions. FreeRASP checks whether the system VPN is enabled.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/system-vpn-detection>

[^9]: ADB (Android Debug Bridge) Enabled is a power-user feature activated through the "USB Installation" option in the Developer settings. This state can signal potential security risks, such as apps being installed via USB, the device being connected to a man-in-the-middle (MiTM) proxy, or the device running as an emulator. When ADB is enabled, it allows extensive access to the device, including pulling and pushing files, issuing shell commands, working with the activity manager (e.g., starting activities, broadcasting intents, modifying hidden Android settings, attaching a profiler to a process, or making an app debuggable), and managing packages. Additionally, it enables capturing screenshots, recording the screen, and other actions that can compromise app security and user privacy. FreeRASP detects whether the USB debugging is enabled.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/adb-enabled-detection-android-devices-only>

[^10]: Android developer mode allows deeper system access and debugging capabilities that can bypass app security measures. Developer mode can enable settings that facilitate the installation of uncertified applications and the execution of potentially harmful code, posing significant risks to data integrity and app functionality. FreeRASP detects whether the developer mode is enabled.\
    \
    Learn more:\
    <https://docs.talsec.app/freerasp/wiki/threat-detection/developer-mode-detection-android-devices-only><br>

[^11]: Malicious screen readers are considered one of the weakest points of the Android OS from a security standpoint. These dangerous apps can retrieve any content on the screen by misusing the accessibility features primarily intended for users with disabilities. Captured data typically involve personal information, account balances, and credentials. Hiding the sensitive information is advised in case unwanted screen reader apps are detected.