Android Mobile App Protection

Ways to Prevent App Hacking

We present to you 9 tricks our company uses to safeguard information.

1. Decompilation Prevention

Getting the source code of an unprotected Android application is not a challenge for an experienced developer. To do this, it's sufficient to convert .dex files to .jar and then extract the source code, which is easily readable. Preventing this can be done using specialized tools like JAD, JD-GUI, and dex2jar. However, it should be understood that fully protecting the application from reverse engineering is impossible. It's only possible to make it so difficult for a pirate that it's not worth their while.

Code Obfuscation for Prevention

Appomart uses the ProGuard tool to minimize the likelihood of program hacking. It does a lot, but the main thing is its ability to obfuscate code, making it confusing for hackers to understand. The principle of this tool's operation is as follows: - Finding unused code blocks and deleting them; - Analyzing bytecode of methods with subsequent optimization; - Renaming variable, class, and method names, and so on. The first two procedures optimize the code, while the third one makes it difficult to read.

Writing Some Program Modules in C/C++

To enhance the protection of data that must be stored on the client's device, Appomart uses the NDK. With its help, a part of the code can be moved to .so files, which, in turn, are written in C or C++. The results of decompiling/disassembling such code are hard to read, minimizing the probability of their unauthorized use in other projects.

2. Moving Part of the Application to the Server

One of the most effective ways to protect an application is to transfer a critical part of the program to the server, such as unique algorithms. In this case, important data will be protected from hacking due to the difficulty of penetrating a properly configured server.

3. Encryption Application

If the application sends data to the server, SSL should be applied. However, its use must be approached responsibly. According to our data, about 40% of all applications using SSL are vulnerable to a «man-in-the-middle» attack.

4. Storing Important User Data in Processed Form

Storing important user information, such as balance information, in an open form is a bad idea. It's better to process it using a special algorithm, which we do.

5. Managing Account Data

To ensure application security, it's necessary to refrain from storing the password on the user's device (for permanent login, it's better to use the Credential object). It's also important to minimize the number of requests for account data in the application.

6. Responsible Use of API Keys

Using API keys is a convenient way to verify the authenticity of a connection for a specific user. However, they shouldn't be stored in places with free access, as otherwise, a hacker can obtain the secret code by decompiling the APK file.

7. Use of Reliable Hash Functions

Another important aspect affecting application security is the use of a reliable hash function. Currently, SHA-2 is considered reliable. Others, such as MD2, MD5, and SHA1, have known vulnerabilities that can compromise processed confidential information (e.g., passwords). It's important that the hash function not only be resistant but also sufficiently slow, making it difficult for brute force attacks. Among such functions are scrypt, bcrypt, and PBKDF2.

8. Prevention of Unauthorized Argument Usage

In a secure application, there's no possibility of executing arbitrary commands. To achieve this, it's necessary to create a whitelist of allowed commands and allow users to choose only from those present in it. Otherwise, a malicious actor will have the opportunity to pass an argument to a function that wasn't intended by the developer, leading to, for example, bypassing access restrictions.

9. Prohibition of Data Installation on External Storage

When a user connects a device to a computer as a USB storage device, full access to files on the memory card is opened. In addition, after deleting the application, the information recorded by it on the MicroSD card may remain there. This, in turn, can lead to the compromise of confidential data. We use SQLite to prevent damage from storing critically important information on external storage. Despite the fact that the measures listed above do not guarantee complete security, they minimize the likelihood of hacking. Therefore, be sure to include in the technical task (you can learn about it on the page: Development of technical documentation for a mobile application) requirements related to application protection. If you want to order an Android application, contact us by phone or any other convenient means.

All contacts are listed on the page: https://appomart.com/contacts.