CAPEC-661
Root/Jailbreak Detection Evasion via Debugging
An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides users with access to system debuggers and disassemblers, which can be leveraged to exploit applications by dumping the application's memory at runtime in order to remove or bypass signature verification methods. This further allows the adversary to evade Root/Jailbreak detection mechanisms, which can result in execution of administrative commands, obtaining confidential data, impersonating legitimate users of the application, and more.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-661: Root/Jailbreak Detection Evasion via Debugging: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/661.html and https://cve.bz/cve/capec/661?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Identify application with attack potential] The adversary searches for and identifies a mobile application that could be exploited for malicious purposes (e.g. banking, voting, or medical applications).
1 technique
- Search application stores for mobile applications worth exploiting
Experiment
They probe what they found.
[Debug the target application] The adversary inserts the debugger into the program entry point of the mobile application, after the application's signature has been identified, to dump its memory contents.
2 techniques
- Insert the debugger at the mobile application's program entry point, after the application's signature has been identified.
- Dump the memory region containing the now decrypted code from the address space of the binary.
[Remove application signature verification methods] Remove signature verification methods from the decrypted code and resign the application with a self-signed certificate.
Exploit
They carry out the attack.
[Execute the application and evade Root/Jailbreak detection methods] The application executes with the self-signed certificate, while believing it contains a trusted certificate. This now allows the adversary to evade Root/Jailbreak detection via code hooking or other methods.
1 technique
- Optional: Hook code into the target application.
Prerequisites
A debugger must be able to be inserted into the targeted application.
Skills required
- High skill
Knowledge about Root/Jailbreak detection and evasion techniques.
- Medium skill
Knowledge about runtime debugging.
Resources required
The adversary must have a Rooted/Jailbroken mobile device with debugging capabilities.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Integrity, Authorization | Through Root/Jailbreak Detection Evasion via Debugging, the adversary compromises the integrity of the application. |
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Read Data | Confidentiality, Access Control | An adversary may leverage Root/Jailbreak Detection Evasion via Debugging in order to obtain sensitive information. |
Mitigations
Instantiate checks within the application code that ensures debuggers are not attached.
Weaknesses it exploits
- CWE-489 Active Debug Code
Recent CVEs with these weaknesses
- 8.7CVE-2026-123993
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces…
- 9.8CVE-2026-120637
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by de…
- 9.2CVE-2026-115727
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug de…
- 5.3CVE-2026-15575
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not…
- 7.1CVE-2026-83550
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows f…
- 9.5CVE-2026-100102
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to com…
- 9.2CVE-2026-102628
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled excep…
- 8.9CVE-2026-13313
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root pr…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-121 Exploit Non-Production Interfaces
Examples
An adversary targets an iOS banking application in an attempt to compromise sensitive user data. The adversar…
An adversary targets an iOS banking application in an attempt to compromise sensitive user data. The adversary launches the application with the iOS debugger and sets a breakpoint at the program entry point, after the application's signature has been verified. Next, the adversary dumps the memory region that contains the decrypted code from the address space of the binary. The 'Restrict' flag is then stripped from the application and the adversary resigns the application with a self-signed certificate. The application is now executed without the 'Restrict' flag, while trusting the self-signed certificate to be legitimate. However, the adversary is now able to evaded Jailbreak detection via code hooking or other methods and can glean user credentials and/or transaction details.
MITRE's words, unchanged: CAPEC-661 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.