Android Question How to hide IP address from my apk?

[incendio]

Hi guys,

I tried virustotal.com to scan my apk. This apk is a jRDC application.

After the scan result finished, under Behaviour Tab, on section IP Traffic, there are a list of IP addresses that my apk used.

These IP's addresses was not encryped. Is there a way to hide/encrypt these IP's addresses?

 

[JohnC]

If the scanner detected the IP addresses as plain text in your apk, then you should be able to use simple text encryption to convert the plain text IP addresses into encrypted characters instead of numeric IP strings.

But, if the scanner got those IP addresses by actually monitoring the live connections your app made to somewhere on the internet, then there is nothing you can do about that.

 

[incendio]

Thanks for your reply, will try to encrypt the ip in my app and try to submit it again to virustotal.

 

[JohnC]

You may also need to protect those endpoints with a password or API key and then make a connection to them using something like SSL to prevent man-in-the-middle snooping of the password or API key.

 

[incendio]

You may also need to protect those endpoints with a password or API key and then make a connection to them using something like SSL to prevent man-in-the-middle snooping of the password or API key.

Care to tell me how to protect the end point with password?

 

[JohnC]

If one of the endpoints are a web service, you can add a password parameter to it.

But if the endpoint is only the jRDC, then this thread might help:

jRDC2 is it safe?

sorry for my ignorance but i hear a lot of people saying using PHP is not safe to connect to a MySQL DB. and i hear a lot erel saying the best solution is to use jRDC2. so i tried and watched the whole tutorial of him here i must say that i was surprised that everything worked. so i managed to...

www.b4x.com

 

[Erel]

These IP's addresses was not encryped. Is there a way to hide/encrypt these IP's addresses?

Yes*

* - obfuscated

Code Obfuscation

This tutorial is relevant for B4A and B4J. During compilation B4A generates Java code which is then compiled with the Java compiler and converted to Dalvik (Android byte code format). There are tools that allow decompilation of Dalvik byte code into Java code. The purpose of obfuscation is to...

www.b4x.com

 

[incendio]

Yes*

* - obfuscated

Code Obfuscation

This tutorial is relevant for B4A and B4J. During compilation B4A generates Java code which is then compiled with the Java compiler and converted to Dalvik (Android byte code format). There are tools that allow decompilation of Dalvik byte code into Java code. The purpose of obfuscation is to...

www.b4x.com

I have already done that, this is the code on Main Activity

Sub Process_Globals
    Public ConnSvr as String = "http:xxx.xxx.xxx.xxx:1000/rdc"
End Sub

But the IP address still visible.
Am I doing wrong here?

I am only submitted (online) my apk to virustotal.com, not run the app and let them scan it while the apk runs.

 

[Erel]

Have you compiled in obfuscated mode? The ip address will not appear as a string. You can see it in the generated java code.

 

[incendio]

Have you compiled in obfuscated mode? The ip address will not appear as a string. You can see it in the generated java code.

Yes it is in obfuscated mode.

Here is the screen shot result after the scan

 

[Erel]

Carefully check your code and make sure that the link doesn't appear anywhere else.

 

[incendio]

I use search function in B4A, that link was not found elsewhere, it was only in the Process Global Sub.

 

[Erel]

Search for the link in the generated Java code.

 

[incendio]

Search for the link in the generated Java code.

Where is generated Java code?

 

[Erel]

<project folder>\Objects\src

 

[incendio]

<project folder>\Objects\src

Not found.

I deleted all comments that containts IP address, compiled again and submitted again to virustotal.com and it worked. No IP visible after the scan.

Made some changes, compiled and submitted again, after the scan, IP detected again.
Realy confused.

 

[Erel]

Ignore it. Any network sniffer will find this ip address anyway.