On behalf of Prashanth Thandavamurthy of Arxan Technologies, Inc.
New Threat
Threat Category:
Application: Vulnerable Application
Threat:
Reverse engineering and analyzing the application binary to discover source-code, algorithms, sensitive information and vulnerabilities, for malicious use.
Threat Origin:
OWASP Mobile Top 10 2016 - M9
https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10
Exploit Example:
- Technical Risks of Reverse Engineering and Unauthorized Code Modification
https://www.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification
- iOS App Reverse Engineering
https://github.com/iosre/iOSAppReverseEngineering/blob/master/iOSAppReverseEngineering.pdf
- OWASP Workshop - reverse engineering iOS apps
https://www.owasp.org/images/b/b9/OWASP_Mobile_App_Hacking_(AppSecUSA_2014)_Workshop_Content.pdf
- Andriod APK Reverse Engineering
https://arxan.wistia.com/medias/dfobh06p52
CVE Example:
None
Possible Countermeasures:
- Follow secure coding guidelines
2.Protect application binary from code analysis and reverse-engineering attacks, by ensuring following security controls are built into the application -
a. Control Flow, Code & Data Obfuscation controls to transform the software program into code that’s difficult to disassemble and understand
b. Symbol stripping to remove unused program symbols (which usually convey sensitive information to adversaries) from application binaries
c. Symbol renaming to change easy-to-understand program symbol names (that cannot be removed from applications) to irrelevant names
d. Encrypting parts of or the whole application when stored on disk and when unused at runtime. Also, encrypting data within the application
e. String encryption to hide plaintext string encodings (e.g., sensitive text-based SQL queries or private messages sent to remote trusted servers)
f. Damage to replace sensitive regions with decoy or garbage code when not in use and replace with the original code when in-use
g. Software Diversification and Randomization techniques to eliminate BORE (Break Once Run Everywhere) attack tools
- Leverage vulnerability/penetration testing and ensure that known risks – including those identified in the OWASP mobile top 10 list, in particular, are addressed
References:
Additional Notes:
Hackers are increasingly targeting binary code to launch attacks on high-value mobile applications. A few easy steps and widely available (and often free) tools make it easy for adversaries to directly access, compromise, and exploit application’s code -
a. Analyze or reverse-engineer the binary, and identify or expose sensitive information (keys, credentials, data) or vulnerabilities and flaws for broader exploitation
b. Lift or expose proprietary intellectual property out of the application binary to develop counterfeit applications
c. Modify the binary to change its behavior. For example, disabling security controls, bypassing business rules, licensing restrictions, purchasing requirements or ad displays in the mobile app — and potentially distributing it as a patch, crack or even as a new application
d. Inject malicious code into the binary, and then either repackage the apps and publish it as a new (supposedly legitimate) app, distribute under the guise of a patch or a crack, or surreptitiously (re)install it on an unsuspecting user’s device