Android Question Why B4A Decompiled?

[Hamied Abou Hulaikah]

Hi All,
My B4A generated apk source code "java code" is decompiled easly using any decompile tool, while my C# xamarin generated apk can't be decompiled using the same decompile tool !!!
Any suggestion or explanation to protect our B4A projects more ...

 

[gkoehn]

...is there some books, docs, etc. on "pattern and practices" to protect java mobile apps?

Something to read sometime...
Search google like this...
"secure mobile development best practices" nowsecure

 

[tigrot]

I have written many assembly programs. They can be decompiled, but the source is simple like understand chinese for an italian. If something can be compiled it can be decompiled too. There was a card (isa) to interpret the program code. The whole program was coded to run only on the particular coprocessor. I used it on my best seller, but one day isa was no more available. So end of the games!

 

[gkoehn]

Yes he does. But I still do not know how to protect API Keys.

What if you take and create a text file containing the API keys and url endpoints.
Then use the tool that Erel has in post...
https://www.b4x.com/android/forum/threads/secured-assets-encrypt-your-assets-files.35589
Would that be enough security to foil someones quick attempt at understanding and using your restfull api?

 

[Informatix]

What if you take and create a text file containing the API keys and url endpoints.
Then use the tool that Erel has in post...
https://www.b4x.com/android/forum/threads/secured-assets-encrypt-your-assets-files.35589
Would that be enough security to foil someones quick attempt at understanding and using your restfull api?

And where/how do you store the password to decrypt the assets ?

 

[DonManfred]

store the password to decrypt the assets ?

In a Image prepared with F5Steg?

 

[Informatix]

In a Image prepared with F5Steg?

If he owns F5Steg...

 

[DonManfred]

If he owns F5Steg...

Another good reason to get ProBundle if not

 

[gkoehn]

In a Image prepared with F5Steg?

Yes! That works!

Here is what Erel recommends if you use his tool.
"- Make sure to use a process global variable for the password. The string will be obfuscated."
In some documents about Android Security it states to use android:debuggable="false" in the application manifest.

For instance, I know someone who likes to take this stuff apart.
He is not a Java developer so he does not know Java but if I make an app, he may try to take it apart.
Will Erel's solution make it hard enough for some apk hackers to give up?

 

[Erel]

Will Erel's solution make it hard enough for some apk hackers to give up?

Without strings obfuscation it is trivial to extract the strings. Obfuscation makes it more difficult which naturally helps with hiding sensitive information.

 

[Informatix]

Yes! That works!

Here is what Erel recommends if you use his tool.
"- Make sure to use a process global variable for the password. The string will be obfuscated."
In some documents about Android Security it states to use android:debuggable="false" in the application manifest.

For instance, I know someone who likes to take this stuff apart.
He is not a Java developer so he does not know Java but if I make an app, he may try to take it apart.
Will Erel's solution make it hard enough for some apk hackers to give up?

Do that and I will have three solutions to retrieve the unencrypted assets easily:
- I run the APK on a rooted phone. I wait until the app decrypt the assets then I get the files in the internal folder. All text files are now readable. Erel warns about this weakness in the Secured Assets page.
- I add a few instructions in your code with a smali editor to know the contents of the password string. The obfuscation is removed at runtime when the string has to be used, so I have two possibilites: either I log the content once the obfuscation is removed, or I call the function embedded in your code that removes this obfuscation.
- I add a few instructions in your code with a smali editor to copy all assets in an external folder after their decryption (after the call to UnpackEncryptedAssets).

In brief, protection level: 1/5. Not zero, and a lot better than nothing, but very weak.
I did not mention the solution with a debugger (changing the setting in the Manifest from debuggable="false" to debuggable="true" is not difficult).
To strengthen this protection, you should keep the sensitive data in memory after their decryption and protect the app against changes. I focus on that in ProBundle.

 

[OliverA]

Interesting! Someone help us out and tell us how to do it!

Don't initially store/ship the API keys with your application.

What if you take and create a text file containing the API keys and url endpoints.

Don't initially store/ship the API keys/URL endpoints with your application.

store the password

Don't store/ship the password(s) with your application.

Initially, when the application is run for the first time, have a user authenticate via username/password over the internet (or your local network). Upon successful authentication, provide your user's application with the API keys and URL endpoints that they are allowed to have access to (and only those that they should have access to). You can save the API keys/URL endpoints on the device. The only time you have an issue here is
1) Device gets lost/stolen. Have policies/training in place for informing you (or whoever is in charge of security) as quickly as possible so as to invalidate the API key(s). Once the API key(s) are invalid, no more access is granted. One could still be in possession of the URL endpoints, but without valid API key(s), that is not an issue.

Edit: Use keystore(s) (comment below) for tokens and possibly URL endpoints.

2) User is known for hacking and like's to fool with your application. Don't give them a username/password to access your system and retrieve API keys/URL endpoints.

Oh yeah, make sure all URL access is via HTTPS or all this is mute.

 

[OliverA]

What about project workflow , directions , diagram, functions, events, structure, etc ....
How can we obfuscate them?

If you have an always connected application (an application that is always connected to the internet), then you could push some of the "secret" knowledge to a server for work flow processing. The draw back would be that the device would always have to be connected to the internet and the responsiveness of the application may be impacted by the quality of the internet connection. You would also have to harden the server against hacking. Depending on the "secrecy" of the workflow, this may be a fair trade off.

 

[OliverA]

How do I securely save the Token on the client device? (Maybe there is not a security Risk here...)
How do Banking Apps do it securily? (Or do they?)

This also amends my above comments. Use the devices operating system provided keystore(s) (Android: https://developer.android.com/training/articles/keystore.html)(iOS: https://developer.apple.com/library...ices/KeyManagementAPIs/KeyManagementAPIs.html). Don't try to write your own.

 

[gkoehn]

This also amends my above comments. Use the devices operating system provided keystore(s) (Android: https://developer.android.com/training/articles/keystore.html)(iOS: https://developer.apple.com/library...ices/KeyManagementAPIs/KeyManagementAPIs.html). Don't try to write your own.

Would a B4A user have some code to share on how to use Android's keystore?

 

[Erel]

Would a B4A user have some code to share on how to use Android's keystore?

Please start a new thread for this.

 

[gkoehn]

Please start a new thread for this.

Be happy to! Find new thread at...
https://www.b4x.com/android/forum/threads/how-can-i-use-the-android-keystore-system.91330/