4 ms·

Why doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but

Why doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but that only slows down the amateurs.

joshmn 11y ago
Packets, man. It's about the packets. And a failure to pin your certificate.
DannyBee 11y ago
Because it's not an arms race that can be won? And in most cases, it's a complete waste of time to try?
colejohnson66 11y ago
What about this? > Why doesn't Microsoft do more to prevent C# apps from being decompiled, inspected and recompiled into modified apps? There's not much you can do when you have a very simple interpreted language (or JITed). Take C for example. Sure, you can take the outputted assembly and turn it into something readable, but because it's been optimized, it's not easy to figure out what it means. C# and Java OTOH compile down to a very simple set of assembly instructions. AFAIK, "stack variables" aren't reused as each variable is referenced by its index. If you were to take the JITed output from CIL or Java bytecode, making something readable would be hard.
rms_returns 11y ago
That depends on how well the obfuscator works and scrambles your code. Does it rename ALL classes, variables, methods and constants to gobbledygook? Does it add redundant code every now and then to add more confusion? If you do all that, then it becomes very difficult to crack even for advanced hackers. But ultimately it should be possible as obfuscation is based on a human logic (though executed by machines) - but it will certainly increase the needed difficulty and dedication to a considerable degree.
PretzelFisch 11y ago
It's still not a problem if the client and server write secure code. because you can still man in the middle the packets, or own the emulator where you have direct access to the applications memory to manipulate it. A server cannot trust a client.
anonymousab 11y ago
That doesn't prevent the main 'exploit', which was just inspecting the traffic of the app externally.
Spivak 11y ago
Because that's not security. The security of your system should be able to withstand an attacker that is able to read the source and arbitrarily modify the client. Otherwise you don't really have security -- you're just hoping no one goes through the effort.

Why doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but that only slows down the amateurs.

joshmn 11y ago

Packets, man. It's about the packets. And a failure to pin your certificate.

DannyBee 11y ago

Because it's not an arms race that can be won? And in most cases, it's a complete waste of time to try?

colejohnson66 11y ago

What about this? > Why doesn't Microsoft do more to prevent C# apps from being decompiled, inspected and recompiled into modified apps? There's not much you can do when you have a very simple interpreted language (or JITed). Take C for example. Sure, you can take the outputted assembly and turn it into something readable, but because it's been optimized, it's not easy to figure out what it means. C# and Java OTOH compile down to a very simple set of assembly instructions. AFAIK, "stack variables" aren't reused as each variable is referenced by its index. If you were to take the JITed output from CIL or Java bytecode, making something readable would be hard.

rms_returns 11y ago

That depends on how well the obfuscator works and scrambles your code. Does it rename ALL classes, variables, methods and constants to gobbledygook? Does it add redundant code every now and then to add more confusion? If you do all that, then it becomes very difficult to crack even for advanced hackers. But ultimately it should be possible as obfuscation is based on a human logic (though executed by machines) - but it will certainly increase the needed difficulty and dedication to a considerable degree.

PretzelFisch 11y ago

It's still not a problem if the client and server write secure code. because you can still man in the middle the packets, or own the emulator where you have direct access to the applications memory to manipulate it. A server cannot trust a client.

anonymousab 11y ago

That doesn't prevent the main 'exploit', which was just inspecting the traffic of the app externally.

Spivak 11y ago

Because that's not security. The security of your system should be able to withstand an attacker that is able to read the source and arbitrarily modify the client. Otherwise you don't really have security -- you're just hoping no one goes through the effort.