Auditor - hardware-based intrusion detection APK for Android

Experience Auditor - hardware-based intrusion detection, developed by Daniel Micay, a tool that verifies Android device integrity. It uses cryptographic attestations from the device's Trusted Execution Environment or hardware security module to detect bootloader unlocks, verified boot failures, downgrades, and unauthorized firmware changes. Features include local QR-based cross-device verification, optional scheduled remote checks with email alerts, and open-source attestation code for public audit. Designed for privacy-conscious users, enterprise fleets, and security professionals needing high-assurance mobile integrity checks on Android devices.

The app queries the device's Trusted Execution Environment or hardware security module to obtain cryptographic signatures that reflect bootloader and verified-boot status. This method detects tampering, operating system downgrades, and unauthorized firmware changes by comparing those signatures to an expected state. Local verification uses QR-based exchange so a separate monitor device shows results, while an optional remote service performs scheduled attestations and can send email alerts.

Auditor attests device state using hardware-rooted cryptography

Checks run as discrete cryptographic queries, not continuous intrusive scans

Because Auditor relies on hardware-generated signatures rather than filesystem scanning, it does not perform prolonged background sweeps of user storage. The verification flow is a short attestation request to the secure module, producing a compact result for display or transmission. Remote scheduled checks execute at configured times; the app's model centers on periodic attestations instead of constant monitoring.

Design choices prioritize high assurance and privacy for sensitive deployments

The tool uses hardware-rooted trust and a privacy-first approach that records device-specific cryptographic identifiers to avoid cross-device tracking. The attestation protocol and client code are open source for external review, and the Trust On First Use scheme pins a device identity for later comparisons. These elements make the app suitable for environments that require verifiable, tamper-evident device state reporting.

Some operational familiarity is required for correct use

Local audits need two devices and an understanding of Trust On First Use pairing to avoid accidental trust establishment. The optional remote monitoring path requires configuring scheduled checks and email alerts. Functionality depends on hardware-backed attestation support and Android 8.0 or later; the app is most effective on supported devices such as Google Pixel models and on GrapheneOS, where hardware attestation is fully available.

Auditor is a rigorous choice for high-assurance mobile integrity checks

Auditor is a rigorous option for security-focused individuals and enterprises that need hardware-rooted verification of device integrity, supported by open-source code and a privacy-first model. The main limitation is the dependence on hardware-backed attestation, which restricts full functionality to compatible devices. As a practical tip, perform the initial local pairing in person and schedule remote attestations during idle hours to avoid operational interference.