Root and jailbreak detection
Root and jailbreak detection is a set of client side checks by which a mobile application tries to establish whether the device it runs on has been modified to remove the platform’s restrictions. In mobile security it is an obstacle that raises the cost of analysis, not a boundary, because the code performing the check runs on the attacker’s device.
The checks themselves are well known: looking for management binaries and package names, testing whether privileged paths are writable, inspecting properties that a modified system changes, and detecting instrumentation frameworks attached to the process. Each is a question the application asks of an environment the attacker controls, and the answer can be changed. Hooking the function that returns the verdict is usually quicker than defeating the individual checks.
That does not make it worthless. It removes casual analysis, it makes automated tooling noisier, and layered with obfuscation and integrity checks it costs a tester real time. What it must never do is carry a security decision on its own. An application that permits a transaction because the device reported itself unmodified has placed the control on the wrong side of the trust boundary.
The honest recommendation, and the one clients most often push back on, is to move the decision to the server using mobile app attestation, where a platform signed statement about the device and the application is verified by a backend that the attacker does not control. In a report we record how long the bypass took, because that is the only meaningful measure of what the control bought, and we assess it against the resilience requirements of the OWASP MASVS rather than as a pass or fail. That is how it is handled in the mobile testing where these checks are bypassed as a first step, not treated as the finding.