Description

The application does not have anti-reverse engineering protections. Sophisticated reverse engineering tools and techniques could bypass weak security controls against reversing protection.

Impact

- Reveal cryptographic constants and ciphers. - Steal intellectual property. - Perform attacks against back end systems.

Recommendation

- Encrypt the executable version of the software. - Use additional protection against reverse engineering, a combination of obfuscation techniques. - Extend the same protection to software or firmware upgrades. - Select automated anti-reversing techniques based on which one could provide a best fit for business security goals, performance requirements, and cost sensitivity.

Threat

Anonymous attacker performing an analysis of the final core binary to determine its source code, algorithms and resources embedded within the app to execute dubious actions.

Expected Remediation Time

⏱️ 450 minutes.

Details

https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#owasp-masvs

Requirements

Fixes