Singpass App on Custom ROMs

[IOKNEE]

sometimes im not sure if we should post all these... those scums prolly looking at this thread and is making counter measures right now.

very likely.
any suggestion on other discussion channels? this is the only place that I can get help on this. I tried to sneak in my question regarding my OCBC app issue but no reply also.

 

[roidred]

very likely.
any suggestion on other discussion channels? this is the only place that I can get help on this. I tried to sneak in my question regarding my OCBC app issue but no reply also.

bro try to freeze the renamed magisk manager using icebox for ocbc

 

[heng_ah]

Updated shamiko to v0.7.3 and suddenly dash app can detect root. Oh well…..

 

[IOKNEE]

bro try to freeze the renamed magisk manager using icebox for ocbc

OCBC app works again after freezing the (hidden) Magisk Manager app! Thanks a bunch for the tip!

I almost went to OCBC to request them to change my secure token to the OCBC hardware token instead of my rooted phone.

Note 1: I used another app to freeze Magisk Manager, not icebox
Note 2: Just wondering, what kind of trick OCBC app used that it could detect the (hidden) Magisk Manager app?

 

[IOKNEE]

Updated shamiko to v0.7.3 and suddenly dash app can detect root. Oh well…..

What if you downgrade shamiko?
Not drawing any conclusion yet, but sometimes there can be bugs in the plugin, we're worldly humans, not transcendent beings.

 

[gascooler]

hi guys, can I understand how sensitive Singpass & local banking apps are? E.g. does it only detect root, or does it also detect unlocked bootloader?

 

[IOKNEE]

hi guys, can I understand how sensitive Singpass & local banking apps are? E.g. does it only detect root, or does it also detect unlocked bootloader?

For now unlocked bootloader (and custom ROM) doesn't trip Singpass yet.
Singpass devs actively/constantly improve their root detection.
It's unclear if certain custom ROM can avoid detection more easily.
In theory, using XPosed (and its variations) increases the chance of being detected.
OCBC seems more strict than DBS.
Unsure about other banks.

EDIT: if any DBS guy reads this, don't be offended, I'm not trying to say that OCBC is better. OCBC's recent absurd security measures make the account owner suffer when touching his own money.

 

[gascooler]

For now unlocked bootloader (and custom ROM) doesn't trip Singpass yet.
Singpass devs actively/constantly improve their root detection.
It's unclear if certain custom ROM can avoid detection more easily.
In theory, using XPosed (and its variations) increases the chance of being detected.
OCBC seems more strict than DBS.
Unsure about other banks.

EDIT: if any DBS guy reads this, don't be offended, I'm not trying to say that OCBC is better. OCBC's recent absurd security measures make the account owner suffer when touching his own money.

oh dear, I use ocbc too. so ocbc checks for unlocked bootloader & refuses to let you sign in is it?

 

[IOKNEE]

oh dear, I use ocbc too. so ocbc checks for unlocked bootloader & refuses to let you sign in is it?

I don't know what OCBC app checks.
For now it's still possible to use OCBC app on rooted phone at your own risks (as usual).

 

[roidred]

OCBC app works again after freezing the (hidden) Magisk Manager app! Thanks a bunch for the tip!

I almost went to OCBC to request them to change my secure token to the OCBC hardware token instead of my rooted phone.

Note 1: I used another app to freeze Magisk Manager, not icebox
Note 2: Just wondering, what kind of trick OCBC app used that it could detect the (hidden) Magisk Manager app?

more than that i wonder what happens when these guys will change job like ocbc guy joins singpass. we can close shop. they all have different logic. if can combine all logic then game over.

 

[roidred]

For now unlocked bootloader (and custom ROM) doesn't trip Singpass yet.
Singpass devs actively/constantly improve their root detection.
It's unclear if certain custom ROM can avoid detection more easily.
In theory, using XPosed (and its variations) increases the chance of being detected.
OCBC seems more strict than DBS.
Unsure about other banks.

EDIT: if any DBS guy reads this, don't be offended, I'm not trying to say that OCBC is better. OCBC's recent absurd security measures make the account owner suffer when touching his own money.

DBS is the way to go in their approach. OCBC thinks they are cool and making people life difficult and for the banks we can always use browser i know its little hassle again very few might use it everyday. everyday app is ad free Youtube

 

[vibranze]

Sorry if my question is out of topic but can I ask for tapping the public transport for payment using Android phone, what is needed ah? Is it Simplygo app eith registered ezlink added to it or Gpay with credit card added to it? Thanks.

 

[twosix]

Sorry if my question is out of topic but can I ask for tapping the public transport for payment using Android phone, what is needed ah? Is it Simplygo app eith registered ezlink added to it or Gpay with credit card added to it? Thanks.

Just use gpay or spay (Samsung phones) to tap. No need to setup simplygo app unless u want to track the spent.

 

[vibranze]

Just use gpay or spay (Samsung phones) to tap. No need to setup simplygo app unless u want to track the spent.

If there phone and CC are from overseas and gpay can't be found in the play store, will the simplygo only works for transport payment if I added the ezlink card to the app? Thanks.

 

[twosix]

If there phone and CC are from overseas and gpay can't be found in the play store, will the simplygo only works for transport payment if I added the ezlink card to the app? Thanks.

Simplygo app is for tracking only . You can't use it to tap. Just tap the ezlink card directly.

 

[vibranze]

Simplygo app is for tracking only . You can't use it to tap. Just tap the ezlink card directly.

Ah ok, got it now, thanks

 

[roidred]

Sorry if my question is out of topic but can I ask for tapping the public transport for payment using Android phone, what is needed ah? Is it Simplygo app eith registered ezlink added to it or Gpay with credit card added to it? Thanks.

yea its off topic but we dont mind not like the devs who work on root detection

 

[spinning_quirK]

Seems like Magisk Alpha (a fork by Shamiko devs) and latest Shamiko are able to do the job. According to xda thread.

 

[IOKNEE]

Seems like Magisk Alpha (a fork by Shamiko devs) and latest Shamiko is able to do the job. According to xda thread.

thanks for the info. will try when the time comes.

 

[vibranze]

Hi, just unlocked my bootloader, installed Magisk root, Singpass can't proceed further and get locked. What's the workaround to hide root? Tried Zygisk and SafetyNet module but same result. Any recommendation would be great. I can't disable the services and providers in App MAnager too, it said rules are not applied. Thanks.

Update: v16.2 being forced to to the latest version, couldn't find o.bMe, o.DN, o.IM, o.Jw but got o.bkk, o.DD, o.li, o.IR instead, disabled them in services and providers. After face verification, agreed to everything, it said something went wrong, try again later. (83-T991)

Anyone get YouTrip working? Thanks.

Temporary Workaround for Singpass:

- Uninstall 18.1.1, downgrade to 16.2.1

- Make sure Magisk 26.1, Shamiko 0.7.3 (174), Universal SafetyNet Fix v2.4.0-MOD_1.3 Displax MOD and FDroid App Manager are installed

- Enable Zygisk, Add Singpass to Denylist (Do not enable Enforce Denylist)

- In App Manager, disable the following:

Services: o.bMe, o.DN, o.IM, o.Jw, sg.ndi.push.service.FcmListenerService

Providers: o.EZ, o.sN

- Clear all Singpass App Data under App Settings

- Reboot

This gets rid of the forced update popup. Singpass Secure Token setup works, and able to access all services without problems.

Not sure how long this will continue to work though. They may eventually stop allowing older app versions from accessing the service.