Magisk: UBS Access & UBS Mobile Banking can detect root despite Magisk Hide

[robertototaro]

Hello,

Two e-banking apps by UBS (UBS Access & UBS Mobile Banking) can now detect root in spite of Magisk Hide (even with the latest Canary release). Both apps used to work till a recent update, but now they detect root as soon as they are started.

I tried the following:

• Enable Magisk Hide
• The above plus Hide Magisk Manager (with a neutral name - my son's name)
• Enable Magisk Hide and completely remove Magisk Manager
• All the above plus removing everything that needs root
• All the above plus disabling USB debugging & developer options

It goes without saying that I have no Magisk related files laying around in the filesystem. Also, after every test I completely cleared the e-banking apps storage.

I tried this on two phones (1+ 6 and 6T) running OOS 10.0.1 stock (apart from unlocked bootloader and Magisk). Both phones pass SafetyNet, are listed as certified in Google Play and no other app I have (e.g. other e-banking apps) can detect root.

The only way to use these apps is completely removing Magisk from the phone.

[topjohnwu]

1152

[letic]

Hey @robertototaro,

I had the same issue. In order to make it work you need to go into Magisk's options and choose to rename Magisk package name. Once this is done you will be able to run UBS Access.

Hope this help
Take care
LeTic

[robertototaro]

Hi LeTic,

Which version of Magisk, Magisk Manager and of the UBS app are you using? Hiding the Magisk Manager used to work till a couple of months ago, but then an update of the UBS Access app broke it again.

Regards,
Roberto

[letic]

Latest version. I just setup Magisk today.

Magisk 7.5.2-1e2de1bb(272)
Magisk 20.4-0dc9f5c3

Magisk is renamed to "Manager" in the app and its package name is a random hash.

UBS Access 3.7.9.3

I just tried restoring Magisk to its original package name and UBS Access stopped working but after rechanging it, it worked like a charm again.

[robertototaro]

Thanks. I'm using Magisk Manager 7.5.1 + Magisk 20.3. I'll try switching to the Canary channel.

[Tomblarom]

I was able to bring UBS Access to work. It worked for a while, but suddenly detected root. I'm using Magisk Manager 7.5.1 and Magisk 20.3, Android 9 (lineage_polaris 190405.003885f5c804a)

Do the following steps:

• Remove UBS Access & Banking (have your Access Card + Reader on hand)
• Magisk Manager > Settings > Repack > name something like "Settings"
• Ensure you're passing SafetyNet (otherwise try modules like PetNoires SafetySpoofer)
• Install UBS Access (don't launch it!!)
• Magisk Manager > Hide > select UBS Access
• reboot (optional)
• Launch UBS App and enjoy!

[imr0]

I'd like to add that Magisk Hide was working for me as described above until today's update to UBS Access App version 3.7.11.0. Now the app is detecting root. :/
This method still works with version 3.7.9.3 though.

My config:
→ LineageOS 17.1 April 28th build for OG Pixel (sailfish)
→ Magisk 2.04 with MagiskManager 7.5.1 with Magisk Hide enabled for UBS Access App
→ SafetyNet passed via MagiskHide Props Config module

[letic]

Same here. I had to downgrade to 3.7.9.3.

On 28/04/2020 19:52, imr0 wrote:
>

I'd like to add that Magisk Hide was working for me as described above
until today's update to UBS Access App version 3.7.11.0. Now the app
is detecting root. :/

My config:
→ LineageOS 17.1 April 28th build for OG Pixel (sailfish)
→ Magisk 2.04 with MagiskManager 7.5.1 with Magisk Hide enabled for
UBS Access App
→ SafetyNet passed via MagiskHide Props Config module

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/topjohnwu/Magisk/issues/2163#issuecomment-620760304,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AADFEE5MZED3UIBOVBGRACDRO4JVXANCNFSM4J4LTXKA.

[VV-Cephai]

How did you downgrade?

[letic]

Unfortunately it is not possible to downgrade through adb for
application that do not have the debug flag. So you have to uninstall it
and re-install the apk downloaded from any apk mirror through adb install.

On 30/04/2020 17:36, VV-Cephai wrote:
>

How did you downgrade?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/topjohnwu/Magisk/issues/2163#issuecomment-621931214,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AADFEE7BZ7WKOOLXPK5IEFTRPGLHPANCNFSM4J4LTXKA.

[seemebreakthis]

As of this morning 3.7.9.3 is starting to force you to upgrade to their latest version. So I think we are back to square one.

I believe (I haven't tried myself) one way to successfully bypass the check, albeit very inconvenient, is to delete magisk manager then run UBS Access. Anecdotal observation suggests it checks for the presence of Magisk Manager only. The latest version must have been updated to detect the new Magisk Manager so when it gets deleted (after you have added UBS Access to Magisk Hide), UBS Access will run. Then it is a matter of reinstalling MM afterwards.... (and do this each you you need to run UBS Access).

[Raptor039]

Tested what you have suggested and it's not working unfortunatly...

I don't understand why a bank like UBS is spending lot of money into R&D to stop us using their 2FA crappy app... I mean, it's a privacy violation that a third party scans or looks for which types of apps are installed on our device!

[letic]

@topjohnwu I will open a new issue to track this recurring issue but what do we need to provide you to be able to debug it ?

Can we run something similar to strace to check what the app is trying to access and see how it detects the root ?

Thanks in advance

[seemebreakthis]

@letic hello if there is a new issue for this, I'd like to get a link to it so I could track progress.

I discovered recently about isolation apps so I treid "Island" but while it works for another backing app I have, there must be something "UBS Access" can detect even in the work profile environment, as the app still crashes even inside the island.

[letic]

Well I solved my issue by changing bank :) Sorry guys.

On 12/08/2020 13:18, seemebreakthis wrote:
>

@letic https://github.com/letic hello if there is a new issue for
this, I'd like to get a link to it so I could track progress.

I discovered recently about isolation apps so I treid "Island" but
while it works for another backing app I have, there must be something
"UBS Access" can detect even in the work profile environment, as the
app still crashes even inside the island.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/topjohnwu/Magisk/issues/2163#issuecomment-672811088,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AADFEE5ULQC3YMCLEO3ISN3SAJ265ANCNFSM4J4LTXKA.

[alain57]

someone managed to fix that ?
Of course changing the bank is one way of fixing this.

I really hate it when banks add such limitation, this is crazy
They are not fobiding us to use their banking when you're the admin of your computer, so why do this one phones :/
That they make a warning appear saying that a rooted device can be dangerous as a virus could steal the informations ok why not (did they scan the PC to know if you have an anti virus ?!? no so why do this kind of joke on mobile a mobile I own !)
But forbidding the app of launching ...........

[Raptor039]

someone managed to fix that ?
Of course changing the bank is one way of fixing this.

I really hate it when banks add such limitation, this is crazy
They are not fobiding us to use their banking when you're the admin of your computer, so why do this one phones :/
That they make a warning appear saying that a rooted device can be dangerous as a virus could steal the informations ok why not (did they scan the PC to know if you have an anti virus ?!? no so why do this kind of joke on mobile a mobile I own !)
But forbidding the app of launching ...........

Unfortunately not... I ended up to remove this shitty app from my phone. I'm keeping it on my iPad when needed, to do some transfers for instance. Changing bank, like you, isn't a solution for me.