Introduction

Untitled

Attack vector

Our attack vector is easy in this issue type as an attacker will typically download our applications onto their devices and unpack them using specific tools, we will be setting up a specific chapter around this. Tools might include:

• IDA Pro
• Hopper
• otool
• Strings
• Etc...

Security Weakness

There is no direct security weakness at play here as by nature, all code is capable of being reverse engineered.

Impact

• Gain intelligence needed to perform subsequent code modification.
• Intellectual Property theft;

Prevention

To prevent this, companies often rely on the use of obfuscation tools of which a whole range of free and paid tools exist though we have to be careful with obfuscation as it can be quite resource intensive to deobfuscate the code at runtime.

A good obfuscator will have the following abilities:

• Narrow down what methods / code segments to obfuscate;
• Tune the degree of obfuscation to balance performance impact;