Antitamper Mobile - Minded Security's Magik Quadrant for Mobile Code Protection (2018 Edition)

Minded Security's Magik Quadrant for Mobile Code Protection shows our evaluation of the top vendors in this market, based on our research and experience, updated to 2018.

Magik Quadrant

 

Why care about Code Protection?

The main reason lies in the fact that Mobile Applications runs within an environment that is not under the control of the organization producing the code.

Lack of Code Protection could have the following consequences:

• Malicious users or competitors could decompile the application and gain knowledge about proprietary algorithms or intellectual property
• Using this information, it could be possible to modify the code, repackage it and redistribute it to create a "trojanized" clone of the App
• Revenue loss due to piracy
• Reputational damage

Since 2016, the OWASP Mobile Top 10 has included two new categories related to that, that is M8-Code Tampering and M9-Reverse Engineering.

Code Tampering

Code Tampering is the process of changing a mobile app (either the compiled app or the running process) or its environment to affect its behavior.

The most common code tampering techniques are:

• Code Injection
• Binary Patching
• Local Resource Modification
• Method hooking
• Method Swizzling
• Dynamic Memory Modification  

Tools and frameworks like Frida, Substrate, Cycript, Xposed and FLEX could give an attacker direct access to process memory and important structures such as live objects instantiated by the app. 

They come with many utility functions that are useful for resolving loaded libraries, hooking methods and native functions, and more.

This can provide the attacker a direct method of subverting the intended use of the software for personal or monetary gain.

Code Tampering could be prevented by detecting at runtime that code has been added or changed since compile time.

Reverse Engineering

Reverse engineering a mobile app is the process of analyzing the compiled app to extract information about its source code. 

An app is said to be susceptible to reverse engineering if an attacker can derive a reasonably accurate reconstruction of the source code from the binary.

Reverse Engineering could be prevented by using an obfuscation tool that implements controls like:

• String Encryption
• Name obfuscation
• Control flow obfuscation
• Arithmetic obfuscation

Also to that, it is important to implement anti-debugging techniques and verify if the application is running on a rooted/jailbroken device.

Some commercial tools provides code protection without requiring developers to implement their own custom controls.

The remaining of this blog post is going into details about the tools available in the market in 2018.

Interpreting the Magik Quadrant

The Magik Quadrant study performed on Code Protection solutions takes into account multiple criteria based on Ability to Execute and Completeness of Vision.

Ability to Execute
Vendors must deliver strong functionality in the following areas of capability:

• Techniques implemented
• After Sale Support

Completeness of Vision
Completeness of vision in the Code Protection market considers a vendor’s vision and plans for addressing buyer needs in the future:

• Cross-platform support
• Innovation
• Sale Strategy

Before proceeding, it is worth noting that focusing on the leaders' quadrant isn't always the best choice. There are good reasons to consider market challengers. Moreover a niche player may support a specific needs better than a market leader.


Leaders
Leaders offer products and services that best cover current scenarios and are well positioned for the future. They provide solutions that are cross-platform, so with one vendor is possible to protect many platforms. Their complex solutions provide protection (through obfuscation, encryption, call hiding etc.), detection and reaction (in case an attack is detected).

Visionaries
In general, in any Magik Quadrant the Visionaries are the innovators. They understand well where the market is going and therefore they can provide innovative techniques to protect the applications in a cross-platform environment.

Niche Players
Niche Players, in our research, are vendors that do not offer, at the moment, a cross-platform solution but they are focused on a small segment. Since they are offering platform-specific solutions, in some case they are able to provide innovative and specific solutions for that specific target.

Vendor Strengths and Cautions

Arxan

This analysis pertains to Arxan's Application Protection.

Arxan is one of the most trusted names in application security. They provide protection against a widest range of static and dynamic attacks. The protection, provided by Application Protection, is implemented on different layers giving the chance to select the desired level of security.

Strengths:

• Cross-platform: Android, iOS (Objective-C and Swift applications)
• No changes to the source code 
• Protection from reverse engineering and disassembly through obfuscation
• Sophisticated Anti Code Tampering techniques
• Threat Analytics feature
• Latest OS versions supported

Cautions:

• Price could be higher than expected
• Strong binary obfuscation may interfere with the application functionalities

Company website: www.arxan.com

Inside Secure

This analysis pertains to Inside Secure Code Protection and WhiteBox.
Inside Secure is one of the leaders in the application security market. They provide a cross-platform solution based on different "modules".

Strengths:

• Cross-platform: Android, iOS (Objective-C and Swift applications)
• Strong Code and Flow obfuscation
• Anti-tampering techniques
• Strong cryptographic key protection

Cautions:

• Price could be higher than expected
• Strong binary obfuscation may interfere with the application functionalities

Company website: https://www.insidesecure.com/

Intertrust

This analysis pertains to Intertrust whiteCryption.
Intertrust is relatively new on this market but offers an innovative product that is designed to protect applications at all levels.

Strengths:

• Pioneers in Whitebox Crypto 
• Cross-platform: Android, iOS (Objective-C and Swift applications)
• Tamper Resistance
• Self-defending code
• Code obfuscation
• Anti-debugging techniques
• Cross-checking of shared libraries 

Cautions:

• Price could be higher than expected

GuardSquare

This analysis pertains to GuardSquare DexGuard and iXGuard.
GuardSquare is very famous since they develop and support ProGuard, that is the successful open source obfuscator for the Java language used for Android application. DexGuard is derived from that, while offering more advanced and sophisticated protections.
They have a great experience in Java and Android platform and recently they started offering also iOS support through the iXGuard software.

Strengths:

• Solution is solid and one of the most used thanks also to the Proguard integration in Android Studio
• Cross-platform: Android (Cordova and PhoneGap supported), iOS (Objective-C and Swift applications)
• Large adoption among our customers
• Strong code optimization and obfuscation 
• Anti-tamper detection available for the Android platform

Cautions:

• At this time iXGuard is offering only reverse engineering and not Anti-tampering protections for the iOS platform
• As demo policy seems to be changed during 2017, it's harder to obtain evaluation versions; this could be a factor to consider if you have a time-constraint project
• Price also has increased
• Solution is one of the most used so it may be easier to find deobfuscation tools/information comparing to other solutions in the market

Company website: https://www.guardsquare.com

Licel

This analysis pertains to Licel's DexProtector.
Licel is a new competitor in code protection. Its product, DexProtector, is designed for comprehensive protection of Android applications mainly against reverse engineering, clone protection and tampering.

Strengths:

• Affordable for our clients
• Strong code obfuscation
• Clone protection
• SSL Pinning support
• Root and Debug Detection

Cautions:

• Available only for the Android platform
• Some feature like Hooks Detection are additional features of the Enterprise version and priced separately

Company website: www.licelus.com

Bangcle - SecNeo

This analysis pertains to Bangcle AppShield, AppSCO and WhiteCrypto.

Strengths:

• AppShield offers protections against debuggers, tampering, decompilation and malware insertion for Android applications
• AppSCO offers reverse engineering protections (Android and iOS platform)
• WhiteCrypto offers strong key protections (Android and iOS platform)

Cautions:

• Anti Code tampering techniques are only offered for the Android platform 

Company website: http://www.bangcle.co.kr - https://www.secneo.com

Zelix

This analysis pertains to Zelix KlassMaster.
Zelix has a long story and experience in code obfuscation. Since its release in 1997, the Zelix KlassMaster Java code obfuscator has been continually developed to keep it at the forefront of obfuscation technology.
This solution provides a Java code obfuscator but it does not implement other protections such as those against code tampering attempts.

Strengths:

• Strong code and flow obfuscation
• Strong Call Hiding
• Affordable for our clients

Cautions:

• Available only for Java (Android)
• Only code protection/obfuscation

Company website: www.zelix.com

Promon

This analysis pertains to Promon SHIELD.
Promon is a Norwegian firm specializing in app hardening focusing largely on Runtime Application Self-Protection (RASP).

Strengths:

• Cross-platform: Android, iOS (Objective-C and Swift applications)
• Rooting and Jailbreak detection
• Repackaging Detection
• Protections against Runtime App Tampering
• Debugger Detection
• SSL Pinning
• Hook Detection

Cautions:

• New player in 2018 Magik Quadrant
• "RASP" acronym usually applies to solutions that protect applications from vulnerabilities at runtime, it could not fit 100% this solution

Company website: https://promon.co


Important note: it is worth noting that all these security controls do not give a guarantee that mobile applications are going to be 100% secure, but they can provide additional protection and make very hard for an attacker to carry on reverse engineering, tampering and runtime attacks.

Shhlack, message encryption for Slack

A common problem about centralized messaging solutions is the sharing of sensitive information during day by day use, preserving, at the same time, message integrity and privacy.

Sometimes two parties may need to share some information that is confidential and should not be accessed by a third party.

A third party could be, for example:

• a service provider
• an external attacker
• a malicious operator of the platform

Conversations may be exposed to third parties, for example, in case of account compromise or by storing Slack backups insecurely.

How many users share passwords directly via Slack private messages?
I hope just a few, but the sad truth is... probably many.

 

Protecting Slack users Privacy after Policy Update

Scenarios are getting more complex after the introduction of GDPR and new Slack privacy policy.

Starting April 20, under the updated privacy policy, Slack compliance reports are being discontinued and the downloading options expanded. Those who buy the Plus plan can request access to “a self-service export tool” to download “all data from their workspace.” This includes “content from public and private channels and direct messages.”

And most important:

Automatic notices to employees will be discontinued. The employer will now decide whether users will be told their conversations are being exported.

Employers may decide to not inform users about conversation export; therefore company Slack users may not be informed of the export with a result of not being alerted of the potential data exposure.

Even if this feature could have its benefits, it could also be abused by a malicious third party to access conversations without alerting company users.


For more information regarding the analysis of Slack privacy policy update:

•  https://www.nbcnews.com/better/business/slack-updates-privacy-policy-employers-can-read-private-dms-without-ncna862811

Summing up the latter news and our previous concerns about centralized storage of sensitive information, we decided to create something on top of Slack in order to add per message encryption via pre shared keys, that's why Shhlack was created.

 Shhlack is an opensource tool available on GitHub:

• https://github.com/mindedsecurity/shhlack

Shhlack: Welcome to the era of encrypted Slack!

Shhlack is an extension for Slack and brings end-to-end encrypted messages in Slack workspaces.

Shhlack is available as

• Google Chrome Extension,
• Firefox Addon 
• Slack Standalone Patcher (Windows/MacOS/Linux).

Shhlack is not a Slack bot. Instead it injects itself in the Slack web UI and uses Slack internal client APIs to encrypt/decrypt messages on the fly by choosing a passphrase from a set of stored keys owned by the user using cryptojs.AES JS library.

When a user receives an encrypted message and owns the correct PSK, message will be shown as preformatted text:

On the other hand any user that receives the message but hasn't Shhlack installed or doesn't own the correct PSK, will see the content as a bunch of base64 encoded "garbage":

It supports the usage of multiple keys, meaning that a user can have more than one key that can be shared with other users.

At the moment Shhlack relies on pre-shared keys that need to be exchanged between users to get the ability to send and receive encrypted messages.

To facilitate PSK exchanging it is possible to import/export the keys as base64 encoded JSON object.

Creating Messages 

In order to create a new message click on the Shhlack icon near the message bar or press Alt+S and a dialog box will appear:

Then:

• To give Slack the opportunity to index some clear text data for future text based search it is possible to add a title that will be kept as clear text
• then the user can choose a particular PSK from the storage
• finally the super secret message can be written and sent.

NB:

Slack servers won't see anything in clear text, nor Slack Bots. Only users - and bots - owning the correct PSK will be able to get the unencrypted content.

Improvements and Future Expectations

If, as we hope, this project will get some traction from the public and a community will help us maintaining the code and add new features, there's a very exciting TODO list such as:

• Use of browser WebCrypto features to encrypt the PSK set on the client itself with a secret masterkey.
• Per channel encryption
• Improve message rendering features, encrypt snippets and releated
• Asymmetric message encryption via public/private certificates
• your feature request!

Enjoy Shhlack and experiment as much as you want!

We'll be looking forward to get your feedback.

Antitamper Mobile - Minded Security's Magik Quadrant for Mobile Code Protection

Minded Security's Magik Quadrant for Mobile Code Protection shows you our evaluation of the top vendors in this market, based on our research and experience.

Magik Quadrant

Why care about Code Protection?

There are a lot of reasons to care about Code Protection when dealing with Mobile Applications.
Every year a lot of money is lost due to piracy, intellectual property theft, cracked copyright mechanisms, tampered software, malware, and so on.

Mobile Apps are obviously installed client-side, therefore they are under the user's control.

For example, malicious users or competitors could decompile the application and analyse the result.
This could reveal valuable data as proprietary algorithms or intellectual property or allow the attackers to use that information to modify the code, repackage and redistribute it to create a "trojanized" clone of the App in a rapid fashion.

Moreover, if the App needs to run on untrusted devices, any malware could interact with the App at runtime level to steal data (credentials, credit card number etc.) or bypass security logic (local authentication, geo-restrictions, custom cryptography etc.).
As you can see a mobile App could be attacked at various layers and with very different goals in mind, creating a very complex problem for those who want to protect their products.
The following diagram shows some of the main attack types.

Why Apps reverse-engineering and tampering are easy?

Many developers do not know how easy mobile application reverse-engineering and tampering are. 

Since mobile Apps reside on user's devices and include valuable data inside  -  metadata, resources and even the code itself -, attackers could gather important information just by using publicly available tools.

In fact, according to the OWASP Top 10 Mobile Risks 2014,

“...it is extremely common for apps to be deployed without binary protection. The prevalence has been studied by a large number of security vendors, analysts and researchers.”

Without protections, it is quite easy to decompile an App to analyse its code (particularly on the Android platform) or to interact with it at runtime level on rooted/jailbroken devices.

How to make it harder?

To make the life harder to the attackers and help protecting valuable data, developers should:

• Harden DRM systems and licensing modules
• Reduce piracy
• Protect intellectual property and personal data
• Secure proprietary algorithms against analysis and reverse engineering
• Harden firmware and OS
• Protect cryptographic keys
• Protect the client side of encrypted communication
• Prevent malware intrusion

Therefore they have to deploy mobile applications with some kind of protection. To do this they could implement the following techniques:

• Code and Flow Obfuscation
• String and Class Encryption
• Debug code stripping
• Method Call Hiding (Reflection)
• Resource Encryption
• Debug Detection
• Root/Jailbreak Detection
• Runtime Injection Detection (Swizzle/Hook Detection)
• Tamper Detection
• Certificate Pinning
• Watermarking

There are many technical resources on Internet that describe at some level of detail how to implement one or more of the preceding techniques.
Moreover, there is some commercial tool which provides binary protection without requiring developers to implement their own custom controls.

Before going into detail about these tools it is worth noting that all these security controls do not give a guarantee that mobile applications are going to be 100% secure, but they can provide additional protection and make very hard to carry on reverse engineering, tampering and runtime attacks.

Interpreting the Magik Quadrant

The Magik Quadrant study performed on Code Protection solutions takes into account multiple criteria based on:

• Ability to Execute
• Completeness of Vision

Ability to Execute

Vendors must deliver strong functionality in the following areas of capability:

• Techniques implemented 
• After Sale Support

Completeness of Vision

Completeness of vision in the Code Protection market considers a vendor’s vision and plans for addressing buyer needs in the future.

• Cross-platform support
• Innovation
• Sale Strategy

Before proceeding it is worth noting that focusing on the leaders' quadrant isn't always the best choice. There are good reasons to consider market challengers. Moreover a niche player may support a specific needs better than a market leader.

Leaders

Leaders offer products and services that best cover current scenarios and are well positioned for tomorrow. They provide solutions that are cross-platform, and therefore with one vendor it is possible to protect many platforms.

Their complex solutions provide protection (through obfuscation, encryption, call hiding etc.), detection and reaction (in case an attack is detected).

Visionaries

In general, in any Magic Quadrant the Visionaries are the innovators. They understand well where the market is going and therefore they can provide innovative techniques to protect Apps in a cross-platform environment.

Niche Players

Niche Players, in our research, are vendors that do not offer, at the moment, a cross-platform solution but they are focused on a small segment.

Since they are offering platform-specific solutions, in some case they are able to provide innovative and specific solutions for that particular target.

Free and Open Source Solutions

The preceding analysis was done on commercial tools available on market.
In addition to this, we have also analyzed a free and open source solutions available for iOS: iMAS.
This solution has the main disadvantage that, since it is free and open source, it does not guarantee support. Nevertheless, we want to spend some words about it since it has some interesting features.

Vendor Strengths and Cautions

Arxan

This analysis pertains to Arxan's GuardIT.
Arxan is one of the most trusted names in application security. They provide protection against a widest range of static and dynamic attacks. The protection, provided by GuardIT, is implemented on different layers giving  the chance to select the desired level of security.

Strengths

• Cross-platform (Android, iOS, Windos Phone)
• Strong code protection
• Strong detection
• Capability to repair after damage

Cautions

• Price could be higher than expected

Company website: www.arxan.com

Metaforic

This analysis pertains to Metaforic Core, Authenticator, Concealer and WhiteBox.
Metaforic is one of the leaders in the application security market. They provide a cross-platform solution based on different "modules" (Core, Authenticator, Concealer and WhiteBox).

Strengths

• Cross-platform (Android, iOS)
• Strong Code and Flow obfuscation
• Strong cryptographic key protection

Cautions

• Price could be higher than expected

Company website: www.metaforic.com

WhiteCryption

This analysis pertains to whiteCryption's Cryptanium.
WhiteCryption provides code protection solutions since 2009, so they are relatively new on this market compared to Arxan or Metaforic. However they offer an innovative product that is designed to protect applications at all levels.

Strengths

• Cross-platform (Android, iOS)
• Strong Code and Flow Obfuscation
• Strong anti-tampering protection
• Anti-debug and anti-piracy features

Cautions

• White-box cryptography techniques are still adopted very little

Company website: www.whitecryption.com

PreEmptive

This analysis pertains to DashO and .NET Obfuscator.
The first version of DashO was released in 1998 and .NET Obfuscator was initially released few years later. Therefore PreEmptive has a long experience in Code protection.

Strengths

• Cross-platform (Android and Windows Phone)
• Strong code and flow obfuscation
• Watermarking
• Tamper prevention and reaction

Cautions

• No iOS support

Company website: www.preemptive.com

GuardSquare - Saikoa

This analysis pertains to DexGuard.
GuardSquare is very famous since they develop and support ProGuard, that is the successful open source obfuscator for the Java language. DexGuard is derived from it.
They have a great experience in Java and Android platform.

Strengths

• Large adoption among our customers
• Strong code optimization and obfuscation 
• Anti-tamper detection

Cautions

• Available only for Android

Company website: www.saikoa.com

Licel

This analysis pertains to Licel's DexProtector.
Licel is a new competitor in code protection. Its product, DexProtector, is designed for comprehensive protection of Android-applications against reverse engineering and tampering.

Strengths

• Affordable for our clients
• Strong code obfuscation
• Anti-tamper detection

Cautions

• Available only for Android

Company website: www.licelus.com

Bangcle - SecNeo

This analysis pertains to AppShield service. Bangcle provides a service that permits to developers to upload its APK on Bangcle's server and they provide fully automated App shield services. The whole process takes about one hour or less to complete.

Strengths

• Very simple use
• Anti-debug and Anti-tamper features
• App Data Encryption

Cautions

• Available only for Android

Company website: www.secneo.com

Smardec

This analysis pertains to Smardec's Allatori.
Smardec's main goal is to offer you high quality services and products at a reasonable price. Allatori first version was released in 2006 and it has reached these goals.

Strengths

• Strong code and flow obfuscation
• Watermarking
• StackTrace restoring

Cautions

• Available only for Android
• Only code protection/obfuscation   

Company website: www.smardec.com

Zelix

This analysis pertains to Zelix KlassMaster.
Zelix has a long story and experience in code obfuscation. Since its release in 1997, the Zelix KlassMaster Java code obfuscator has been continually developed to keep it at the forefront of obfuscation technology.
This solution provides a Java code obfuscator but it does not implement other protections such as those against tampering tries.

Strengths

• Strong code and flow obfuscation
• Strong Call Hiding
• Affordable for our clients

Cautions

• Available only for Java (Android)
• Only code protection/obfuscation

Company website: www.zelix.com

iMAS

This analysis pertains to iMAS.
This solution is free and open source, available on GitHub, and it provides modularity as the main feature. In particular the iMAS project is composed of many components that developers could include inside their project and every module provides a different feature. So it is up to the developers selecting the desired components and include them in the project.

Strengths

• Free
• Anti-tampering protections
• Code encryption

Cautions

• Available only for iOS
• No after sale support

Company website: project-imas.github.io