App Tampering

App tampering is changing an application’s code, resources, or running behavior so it does something its developer did not intend. That can happen in a modified app package or inside an otherwise authentic app while it is running.^[1]

A familiar interface can hide altered checks or added code. On Android, an attacker can sign a repackaged app with their own key; the presence of a signature alone does not make that package an approved release.^[2][3]

Examples

• A repackaged banking app adds code that observes sensitive information while preserving the original screens.
• A modified client skips a local security check before submitting an onboarding request.
• Runtime hooks replace a camera result or change the return value of an integrity check.

How Cipherstep helps

Cipherstep combines in-app RASP with sealed attestation evidence. RASP can respond to supported interference in the running process, while the Decision API evaluates runtime findings and authenticated collection integrity on the server.

The backend should require a completed evaluation before accepting the protected action. This keeps enforcement outside the client, including when a modified app tries to omit the SDK or reuse an old envelope. Configured approved-release references can also identify unrecognized application metadata for review.

Coverage depends on the platform and release. These checks complement your distribution, signing, and server authorization controls; they do not make a malicious download safe or remove it from a customer’s phone.