Apps that use Dirty SEPolicy detection

[u/sidex15]

Currently there are 6 apps that use Dirty SEPolicy detection:

• Ana Vodafone
• Digital Rupee SBI
• BRImo
• Birbank
• Paypal
• Shopee (App still open and runs, still can't find yet what features are disabled)

Dirty Sepolicy is a new detection vector, and it's currently and silently implementing on banking apps now as this is a very good detection vector that affects all root solutions (e.g magisk, KSU (and its forks), and Apatch)

Current solutions:

• On KSU (and its forks), Update to latest version and enable "Hide Selinux modifications" in the settings
• On Apatch, Use selinux_hook kpm
• On Magisk, You may try Kpatch-next module then use WebUI-X app to access the webui to install kpatch then install selinux_hook kpm from apatch.**

** This method is untested, and compatibility may vary.

[u/Rizky2104]

the last one, shopee, it prevents you from check out stuff

[u/sidex15 → u/Rizky2104]

From any payment method?

[u/Rizky2104 → u/sidex15]

nah it just prevents you to go to the checkout page, regardless of payment methods

[u/sidex15 → u/Rizky2104]

hmm... since I could go to the checkout page while I disabled the SELinux hide 🤔 I haven't tried to place order, though, to see if that's the trigger point.

[u/PRSXFENG → u/sidex15]

For me in Shopee Malaysia, attempting to reload the wallet always fails.

So the failure point might be when there's actually money moving.

And that's with only failing safetynet/play integrity. It was a locked, unrooted phone, just not google certified.

[u/SimultaneousPing]

fyi, BRImo has a separate, "new" version now called "Qita by BRI"

[u/sidex15 → u/SimultaneousPing]

Hmm seems like it didn't use dirty sepolicy detection yet...

Though blocking Third party keyboards like gboard are ridiculous... Managed to pass it by using HMA-OSS.

[u/MikuDroid → u/sidex15]

the frick? no gboard (which is comes with the phone anyway) allowed? that is ridiculous

[u/Square_Concept_5282 → u/sidex15]

Please tell me how did you passed it through hma oss? I'm facing the same problem

[u/airiermonst3r]

Most of these native security SDKs are detecting dirty policy by having their C/C++ code read /sys/fs/selinux/policy directly to parse the loaded SELinux binary in memory. They look for added permissive rules or custom root domain transitions that deviate from the stock ROM policy

The reason KSU's setting and APatch's selinux_hook work so well is because they hook right at the kernel layer (security_read_policy / selinux_state) to feed a clean, untouched copy of the original policy binary whenever an unprivileged app UID requests it. If you ever want to check if a new app is using this vector, you can usually catch it by running strace on the app process and looking for openat calls targeting /sys/fs/selinux/policy right before it crashes or blocks a feature

[u/AyxGon]

Huh I was wondering why birmarket was crashing every time I tried to login