Barclays Mobile Banking root detection

I have been looking at the Barclays apps for a while (on and off). I wanted to get them working on my handset, an Atrix with CM7, and my tablet, a Momo9 clone running CM9. Even hiding root and fully unrooting (by various methods) did not help me.

So I decided to do some proper digging and downloaded dex2jar and jd-gui. After decompiling with these tools, I think I found the root detection routines, and this led me to a simple discovery. Part of the detection routine is to check the Build values (Build.FINGERPRINT and Build.TAGS).

It is my belief, therefore, that they are either checking that the ROM is a known stock firmware, or checking for known rooted ROMs (like CM). This is also suggested by the fact that some people have got it working by hiding root on rooted stock (or stock-based) ROMs.

I am posting this info purely for information to anyone who wants to take this investigation/development further. It is in NRegSplashActivity, which also contains some file existence checks.

I am not bothering to do any more with this. For myself, I feel that if the app is not secure with root (which is the reason I have been told for disallowing root) then it is inherently insecure (as rooting is trivial).