Android is an open-source-based operating system that allows developers to develop apps quickly. However, the fact that easy access and few constraints in development are acting as a security vulnerability. There are plenty of mobile apps produced on Android, but only a few apps with a level of security that users can use with trust. Significantly, the Android operating system is exposed to the risk of hacking through decompiling of the app or reverse engineering.

If a pirated app created by copying the source code of an app through decompilation or reverse engineering is distributed, severe financial loss to the original developer as well as serious adverse effects on the reputation.

In addition, if malware/malicious code is injected into the app for purposes and distributed, it may expose a leakage of personal information or device malfunctions.

Despite such cases, it is not easy for developers to come up with all security systems in developing mobile apps due to technical or time constraints. However, if only the necessary security is applied, issues related to time and money can be easily solved. To solve these realistic challenges, LIAPP TEAM would like to introduce four essential features for Android app security that must be checked before launching the app.

1. Detect and block Rooting

In Android, a feature to detect "rooting" is needed. Most smartphone OS maintains security through the sandbox, and rooting is an act of breaking this. Once rooted, it gets out of the sandbox's control at any time and has all the rights on the smartphone; all the actions of the attacker, such as debugging and memory dump, as well as saving files of other apps, could be done. If the app is enabled to detect rooting, it will be forced to terminate when the mobile app runs on the rooted device.

2. Protect source code

Removal of the source code vulnerability is the typical security activity in the app development phase. Source code obfuscation is a technology that makes the source code difficult to read. Readability of the code is essential to the developers, but code obfuscation is the opposite which reduces code readability and makes it challenging to analyze the logic even if the app is decompiled. Note that this obfuscation technique is not applied when writing the source code but when building. Develop with good readability and convenience while reducing the readability at the building stage. However, note that source code obfuscation is the obfuscation word itself, not encryption, which means it is possible to analyze the code if followed.

LIAPP provides strong security through the encryption of essential source codes and obfuscation to protect source codes. LIAPP provides not a simple rearrangement obfuscation but an encryption solution that blocks all hacking tools at the source.

3. Verify App integrity

Verification of the app integrity is detecting if the app is tampered at the point of running the app. In the case of an Android app with integrity verification, a specific code is included to detect tampering. This code checks whether the app has been tampered with or changed at the time of running the app. If any tampering is detected, the app will stop or restrict. It is currently applied to financial, insurance policy, and mobile game apps which is one of the most basic required functions for app security. However, there are caveats to this method as well. Since the integrity verification logic is also part of the app, there is a risk that the logic will tamper. So, the app integrity verification logic must also be protected through source code obfuscation and source code encryption.

4. Protect input data by users

A virtual keypad should be used to prevent the leakage of essential inputs, such as passwords and identification numbers that users enter when running the app. When important text or input is entered, the masking process makes it invisible on the UI, but it remains plain text within the memory allocated to the running app process. At this time, hackers can take important input through memory dumps. A virtual keypad is used to protect from those hackers; every time each key value is entered, it is stored as an encrypted value, not the value entered by the user. When this input is sent to the server after entering, the input is decrypted in the server. When this logic is implemented, ensure that the encryption channel is not easily breached by encryption using weak algorithms or by designing the encryption key exchange in an insecure way.
LIAPP provides a mobile keypad LIKEY to strongly prevent hacking and leakage of input by receiving different one-time data from the server every time so that the encryption text for the same input is different within one app.

Currently, awareness of Android's security vulnerabilities has increased, and companies from different industries, such as finance, games, and more, are using security solutions, yet apps still need to be protected.

Users may think that the app more people are using, the safer it will be. App developers must first come forward with proper awareness and countermeasures on app security to prevent a problem such as personal information leakage and corporate brand assets leakage. Please check those four checklists before launching the app.

LIAPP, we provide the best service possible.