1

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation?

I have been already using following protections in my application:

  1. Obsufcation using proguard
  2. Anti-java hooking to restrict attacker from bypassing root detection and SSL pinning.

Does anyone have any bulletproof advance technique to implement such solutions? I have come across this solution. Can anyone let me know how effective and practical it is to implement?

Anders
  • 64,406
  • 24
  • 178
  • 215
FrOgY
  • 309
  • 1
  • 10
  • 2
    There is no such thing as a bulletproof anti-tampering or obfuscation technique. Every one that exists can be bypassed. If you found any method to do that, it would be the holy grail of DRM. – forest Apr 17 '18 at 08:47

1 Answers1

3

Code Obfuscation

Obfuscation can only act as a hurdle for an attacker doing secure code review. Paid obfuscators such as Dexgaurd are far better than the free ones and can be used to considerably increase the attack complexity. But, we should not completely rely on obfuscation as an attacker can spend good amount of time to deobfuscate and analyze the code.

Android Anti-Tampering

Android system is built on the top of Linux kernel. A root user(Rooting Android Device) in Linux system is a super user and has all the administrative privileges and so can do almost anything on the system. This includes bypassing the almost all the security implementations implemented in application/device. Therefore, I believe that there is no sure-shot solution to verify the integrity of the application.

Having said that, I suggest implementation of solutions that can help us to considerably increase the attack complexity and build somewhat tamper proof applications and SafteyNet Attestation API is one of them. I personally suggest the implementation of this API for implementing application integrity checks. It is a paid solution as the free quota is very limited. You must check the implementations guidelines properly and it should be securely implemented to get desired results.

For anti-hooking/debugging, I strongly recommend you to check Android Anti-Reversing Defenses that can be implemented to substantially increase the complexity.

Shiv Sahni
  • 921
  • 8
  • 16
  • I don't know if this is entirely correct. Android uses SELinux which can easily restrict the root user. For example, root is unable to tamper with trusted boot (implemented by TrustZone, not SELinux). – forest Apr 17 '18 at 10:57
  • @forest request you please re-read the answer. I have explicitly used the word *almost* here. – Shiv Sahni Apr 17 '18 at 11:08
  • I was thrown off by `and so can do anything on the system`. I assumed that "almost" was referring to hardware-controls. – forest Apr 17 '18 at 11:11
  • 2
    @forest I have added another *almost* in the answer. Your suggestions are welcome. – Shiv Sahni Apr 17 '18 at 11:19