Usb debugging not detected if enabled in between a running app session

[njtec]

Flutter integration, running on android.

Usecase:
Usb debugging is disabled.
I start my app. I put it in background and enable usb debugging.
Rasp detection does not detect or listen to the change unless I restart the app.

Is this expected?

[msikyna]

Hello @njtec ,
we will look into the issue, thank you for reporting it.

Talsec team

[tompsota]

Hello @njtec,

Due to inevitable performance impact, freeRASP cannot perform security scan all the time, which results in a behavior you are describing.
In contrast, the freeRASP performs specific checks, including adbEnabled, periodically. This periodicity interval is randomized, but no longer than four minutes and as of now it is not configurable. This approach helps keep your app responsive while still ensuring threat detection, though with a slight delay.
The only moment you are guaranteed all the detection will be triggered is just after the app launch. If, for example, ADB gets enabled after the app has started, you’ll need to wait for the next scan cycle to complete. Once that happens, the check will run again, and the callback will be triggered.

With Talsec, we offer additional solutions to help overcome this limitation:

1. RASP+
   RASP+ allows you to customize the detection interval in your own SDK build to better match your requirements. We’re also working on a dynamic interval management feature, which will give you even more control over how frequently each check runs. Additionally, RASP+ includes built-in threat responses, so you won’t have to wait for callbacks to react to detections.
   For more details on the differences between freeRASP and RASP+, check out our GitBook: https://docs.talsec.app/freerasp/features-and-pricing-plans/the-key-differences-freerasp-vs.-rasp+
2. AppiCrypt
   AppiCrypt secures communication between your app and backend. It includes the results of the Talsec security audit, which you can verify server-side. This way, you can confirm that the device sending the request has passed the security checks (including adbEnabled) before proceeding with further communication. Learn more about AppiCrypt here: https://docs.talsec.app/premium-products/appicrypt-product-page.

Let us know if you have any further questions.

Regards,

Tomas from Talsec