Compromised Runtimes

A compromised runtime is an app’s execution environment that has been altered or placed under outside control. The installed app may be authentic, but injected code, hooks, or instrumentation can change what happens while it runs.^[1][3]

Root or jailbreak access can make this interference easier by weakening normal platform restrictions. A modified operating system and active app tampering are distinct findings: a rooted phone is not, by itself, evidence that its owner is committing fraud.^[2]

Examples

• A hook changes the result of a security check so the application continues a restricted flow.
• Injected code intercepts an app function and substitutes data before the app builds its request.
• Instrumentation observes or changes a sensitive process inside a rooted or jailbroken environment.

How Cipherstep helps

Cipherstep’s RASP checks for supported interference inside the running app. Attestation collects and seals runtime and platform evidence so the Decision API can assess signs of hooking, instrumentation, debugger attachment, and device modification on the server.

Collect fresh evidence around actions such as identity capture, account recovery, or a transfer. Strong supported manipulation findings can support a block, while a modified environment or unresolved evidence may call for a challenge or review. Your backend applies the response, and analysts can inspect the findings in the portal.

An SDK runs within the device it is assessing. A sufficiently compromised operating system may hide evidence or falsify observations. Runtime protection therefore complements platform updates, authentication, and backend authorization rather than guaranteeing that every compromise is visible.