/

Screen Recording Detection

Protection Module: ScreenRecordingDetection

Available For

This protection module is available for iOS 11 and later. It provides real-time detection of screen recording, AirPlay mirroring, and screen broadcasting using native iOS APIs.

PlatformSupportNote
iOS✓iOS 11+ required for isCaptured API
Framework✓UIKit required
Architecture✓All architectures

How It Works

Screen Recording Detection monitors your application's screen capture state using both system notifications and continuous API polling. It detects active screen recording sessions, mirroring connections, and external display broadcasts.

Detection Techniques

The module employs multiple detection strategies:

  • isCaptured API Monitoring: Polls UIScreen.main.isCaptured property (iOS 11+)
  • Notification Monitoring: Observes UIScreenCapturedDidChangeNotification for state changes
  • ReplayKit Detection: Identifies active ReplayKit recording sessions
  • State Transition Detection: Detects capture state transitions (starting/stopping recording)
  • AirPlay Monitoring: Detects AirPlay mirroring and wireless display connections

Confidence Metrics:

  • System API detection: 1.0 (highly reliable)
  • Notification-based detection: 1.0

Detection Type: Hybrid (event-driven + periodic polling)

JSON Configuration

JSON
{
  "protections": [
    {
      "type": "ScreenRecordingDetection"
      "action": "close"
    }
  ]
}

Code-Based Configuration

Swift

Swift
import ByteHideMonitor

BHMMonitor.configure { config in
    config.enableProtection(.screenRecordingDetection, action: .close)
}

Objective-C

OBJC
#import <ByteHideMonitor/ByteHideMonitor.h>

[BHMMonitor configure:^(BHMMonitorConfiguration *config) {
    [config enableProtection:BHMProtectionModuleTypeScreenRecordingDetection
                      action:BHMActionTypeClose];
}];

Available Actions

ActionBehaviorRecommended For
CloseTerminate application immediatelyProduction apps with critical IP
LogRecord incident and continueDevelopment, analytics
EraseSecurely delete data then terminateFinancial, healthcare apps
CustomExecute custom handlerEnterprise integrations
NoneDetect only, no actionTesting configurations

See Actions for detailed action documentation.

When to Use

Enable Screen Recording Detection if:

  • Your app handles highly sensitive data (credentials, payment info, medical records)
  • You need to comply with industry regulations (HIPAA, PCI-DSS, FINRA)
  • You want to prevent unauthorized video capture of your application
  • You're deploying to production with security requirements
  • You need to prevent credential exfiltration via video recording
  • You want to protect against remote screen capture and mirroring attacks
  • You're building fintech, healthcare, or government applications

Consider using custom actions to implement warning dialogs or graceful data redaction.

Code Examples

Swift - Basic Configuration

Swift
import ByteHideMonitor

class AppDelegate: UIResponder, UIApplicationDelegate {
    func application(
        _ application: UIApplication
        didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
    ) -> Bool {
        BHMMonitor.configure { config in
            config.enableProtection(
                .screenRecordingDetection
                action: .close
            )
        }
        return true
    }
}

Swift - Custom Action with Warning

Swift
BHMMonitor.configure { config in
    config.registerCustomAction("recording-handler") { context in
        let threatType = context.threatType
        let description = context.threatDescription
        let metadata = context.metadata

        // Log the detection
        print("Screen Recording Detected: \(description)")
        print("Detection Type: \(threatType)")

        // Show user warning
        DispatchQueue.main.async {
            let alert = UIAlertController(
                title: "Recording Detected"
                message: "Screen recording is active. Sensitive content will be hidden."
                preferredStyle: .alert
            )
            alert.addAction(UIAlertAction(title: "OK", style: .default))
            self.window?.rootViewController?.present(alert, animated: true)
        }

        // Implement content redaction
        self.hideScreenRecordingSensitiveContent()

        // Log to security analytics
        SecurityAnalytics.logRecordingDetection(
            type: threatType
            confidence: metadata?["confidence"] as? Double ?? 1.0
        )
    }

    config.enableProtection(
        .screenRecordingDetection
        customAction: "recording-handler"
    )
}

private func hideScreenRecordingSensitiveContent() {
    // Blur or hide sensitive views when recording is detected
}

Objective-C

OBJC
#import <ByteHideMonitor/ByteHideMonitor.h>

[BHMMonitor configure:^(BHMMonitorConfiguration *config) {
    [config registerCustomAction:@"recording-handler" handler:^(BHMThreatContext *context) {
        NSString *threatType = context.threatType;
        NSString *description = context.threatDescription;
        NSDictionary *metadata = context.metadata;

        NSLog(@"Screen Recording Detected: %@", description);
        NSLog(@"Detection Type: %@", threatType);

        dispatch_async(dispatch_get_main_queue(), ^{
            UIAlertController *alert = [UIAlertController
                alertControllerWithTitle:@"Recording Detected"
                message:@"Screen recording is active. Sensitive content will be hidden."
                preferredStyle:UIAlertControllerStyleAlert];

            UIAlertAction *okAction = [UIAlertAction actionWithTitle:@"OK"
                style:UIAlertActionStyleDefault
                handler:nil];
            [alert addAction:okAction];

            [self.window.rootViewController presentViewController:alert animated:YES completion:nil];
        });

        [self hideScreenRecordingSensitiveContent];
    }];

    [config enableProtection:BHMProtectionModuleTypeScreenRecordingDetection
                customAction:@"recording-handler"];
}];

- (void)hideScreenRecordingSensitiveContent {
    // Implement content redaction logic
}

Platform Compatibility

ComponentiOS 11iOS 12+iOS 16+Notes
isCaptured API✓✓✓Core detection mechanism
Notification Monitoring✓✓✓Event-based detection
ReplayKit Detection✓✓✓Recording framework detection
AirPlay Detection✓✓✓Mirroring and broadcast detection

Performance Impact

Screen Recording Detection has moderate performance impact:

  • CPU Usage: 0.5-1% per polling cycle (5-second default interval)
  • Memory Overhead: ~2-3 MB for monitoring infrastructure
  • Detection Latency: 10-100ms notification delivery, up to 5 seconds for polling
  • Background Impact: Continues monitoring when app is in background

To optimize performance:

  • Increase intervalMs to 10000 (10 seconds) for less frequent checks if latency is acceptable
  • Use custom actions instead of immediate termination for graceful handling
  • Consider disabling during certain app states if appropriate for your use case

Threat Detection Details

When screen recording is detected, the threat context includes:

JSON
{
  "moduleType": "ScreenRecordingDetection"
  "threatType": "ScreenRecordingActive"
  "threatDescription": "Active screen recording detected via UIScreen.isCaptured"
  "detectionResult": {
    "recordingActive": true
    "detectionMethod": "APIPolling"
    "captureSource": "SystemRecording"
    "confidence": 1.0
  }
  "metadata": {
    "confidence": 1.0
    "detectionMethod": "UIScreen.isCaptured"
    "timestamp": "2024-03-15T10:30:45Z"
    "recordingDuration": 45000
  }
}

Next Steps

Previous
Keychain Integrity Detection
Next
Screenshot Detection