Mobile app shielding is software built into a company's own phone app that protects the app from being taken apart, changed or copied. It is also called app hardening or in-app protection. A related term is runtime application self-protection (RASP), which means checks inside the app that run while the app is in use.
Why does an app need this protection? Once an app is published on an app store, anyone can download its installation file. On Android, this is the APK file. Free tools can turn that file back into code that a person can read. This is called reverse engineering. An attacker who reads the code learns how the app checks logins, which servers it contacts, and any keys left inside it, which are called hard-coded secrets. The attacker can also change the code, rebuild the app and publish the changed copy. This is called repackaging.
Consider a gold-loan company in Thrissur whose app lets customers check their loans and pay their EMIs by UPI. Without shielding, a fraudster could repackage the app with extra code that copies each customer's login and OTP. The fraudster could then spread the copy through links in WhatsApp messages. The fake app would look and behave exactly like the real one.
Shielding is added to the app when it is built, by the CI/CD pipeline, before the app is published. It does four jobs.
First, it scrambles the app's code, so that the readable version is very hard to follow. This is called obfuscation. Second, it hides the keys inside the app, so that they cannot be read from the file. Third, every time the app starts, it checks itself. If its code has been changed, or it is not signed with the company's own key, it refuses to run. Fourth, while the app runs, it checks the phone. It looks for a rooted phone, which is a phone whose built-in protections have been removed. It also looks for debugging tools attached to the app, and for tools that read the screen. If it finds one, the app can block payments, or report the phone to the company's servers.
Mobile app shielding is often confused with mobile threat defence. Mobile threat defence protects a phone, usually an employee's phone, from harmful apps and networks. App shielding protects one app, the company's own, on lakhs of customers' phones that the company does not control. Fake copies of the app published on unofficial websites can be found by external attack surface management (EASM) tools. Shielding belongs to application security, because it is applied to the software before it ships.