What can jailbreak detection and pinning actually achieve, and what are their limits?

A jailbroken device lets the owner run code outside the sandbox: attach debuggers, hook functions at runtime (Frida, Substrate), read app memory and files, and bypass checks. Jailbreak detection tries to notice this from inside the app: the presence of files and paths (/Applications/Cydia.app, /bin/bash), the ability to write outside the sandbox, a writable system directory, suspicious loaded libraries (dyld image names), the ability to call fork or open URL schemes such as cydia://, and a debugger attached (sysctl and P_TRACED). Each check is easy to defeat: tweaks exist whose only job is to hide the jailbreak from those checks, and since the detection code runs on the attacker’s machine, they can patch it out or hook it to return “not jailbroken”. Detection is therefore a speed bump, not a security boundary: it deters casual tampering and gives a risk signal, but it cannot be relied on, and it breeds false positives and support cost on legitimate devices.

The same logic applies to other client-side defences, including certificate pinning (see the networking topic), anti-debugging and binary obfuscation: they raise the attacker’s cost, which is worthwhile for high-risk apps (banking, payments, games with real money), but never replace server-side controls. Do the important work where the attacker cannot reach: authenticate and authorise every request on the server, validate every input, rate-limit and monitor for abuse, keep business rules (prices, balances, entitlements, scores) on the server, and use hardware-backed evidence such as App Attest instead of guessing about the device. A sensible stance: decide what you are protecting against (casual tampering, scalable fraud, targeted attack), apply proportionate layers (pinning, detection as a signal that triggers extra verification or reduced functionality rather than a hard block), assume the client is hostile, and design the backend so that a fully compromised client can do nothing its user could not already do. Regulated apps may require detection by policy, in which case document the limits.