“Kids as young as 11 are using coding skills to hack accounts on social media and gaming sites…” (1)

Time will only tell the types of hacks, capabilities, and even requisite skill level needed to attack software. The exponential growth of young coders exposes the App Economy to compromise of application integrity.

(1) http://mashable.com/2013/02/09/kids-coding/

Consistent with much current industry research, we feel piracy will only increase in 2013 for a few reasons.

The number of mobile OS’s are growing. In addition to popular iOS and Android, as well as ‘backseat’ platforms such as Blackberry and Windows, Tizen and Ubuntu are entering the scene (stage left!). More specifically, Android, the fastest growing OS due to compelling price points*, lacks a robust and standardized security process. For, iOS, although Hackulous has shut down, other websites, especially those hosted in minimal or unregulated territories such as China, we believe will continue to be plentiful and widespread as alternative sources for jailbroken apps. Additionally, many global developers may continue to maintain the importance of a ‘free’ development environment as they view jailbreaking as being about innovation (even though piracy is a consequence) and having the ability to create outside of the iOS sandbox.

Although the lack of iOS 6 jailbreak has been suggested as contributing to the Hackulous shutdown, it is always an arms race for the hacking community. In fact, today, hackers are touting a significant milestone of iPhone 5 running 6.0.2 as finally being jailbroken (iPhone Dev Team member – planetbeing – has revealed his jailbroken iPhone 5). The purported logic from the hacker for not yet releasing the exploit that enables the jailbreak is that it allows hackers to be able to maintain a “window” into new firmware for future jailbreaks. Hence, software publishers can’t expect piracy levels to decrease. In fact, our continued growth in providing more and more customers (we’re deployed on over 200 million devices) with app integrity via our app hardening and tamper proofing products underlines widespread concern on the prevalence of piracy attacks.

Furthermore, as mobile computing continues its stakehold as today’s mainstream platform, the underlying app economy multiplies to address multi-platform software requirements across diverse industries, such as mobile banking/payment, digital media, gaming, etc. Hence, the software piracy and app integrity challenge will undoubtedly follow in at least a linear manner.

*- “The tablet market has seen greater price competition from Android devices as well as smaller, low-priced devices in emerging markets,” Gartner said. “It is ultimately this shift toward relatively lower-priced tablets that lowers our average selling prices forecast for 2012 through 2016, which in turn is responsible for slowing device spending growth in general, and PC and tablet spending growth in particular.”

Mobile application security extends beyond the identification and elimination of code vulnerabilities. As enterprises (of all types, including financials) extend their computing out to the mobile device world, analysis and modification attacks directly on the distributed application binary code becomes a major security threat. This webinar will focus on the range of techniques (with specific tools identified and examples presented) available to reverse engineer and/or tamper with mobile applications. Specific reversing/tampering uses cases focused on the financial vertical will be presented to demonstrate the critical nature of these attack types.

Join our webcast: http://www.brighttalk.com/webcast/288/58489

By Hoi Chang, Vice President, Arxan Technologies, Inc.

According to a recent report by Lookout, 9 million people lost their smartphones in 2011; on average, that’s one lost phone in every 3.5 seconds! From the perspective of mobile security, that is rather scary.

If you are in charge of the security of mobile applications deployed across an enterprise, you’re likely faced with risks due to lost devices, since every lost app could potentially end up in the wrong hands. Although in reality not every lost app may end up harmful, it only takes one determined, malicious hacker to pick apart and compromise one important app, and subject your organization to business risk.

To counter such mobile threats (and more), a number of vendors offer security features such as “secure containers” and “secure wrappers” as part of their mobile device or mobile application management (MDM or MAM) solutions. Typically, these security features wrap unprotected mobile apps with per-app security policies, such as password protection, data encryption, and remote wiping of app data, that protect the apps against illegal access and misuse in insecure environments.

While security policies implemented by MDM and MAM solutions form a very important first line of defense, it can easily be mistaken that this is all you need in securing the apps. An essential but often missing security component is app protection.

Policy code is a security layer protecting against app-level threats such as app misuse and data breach. Without reinforcement by code protection, it can be an easy target of attack – policy code itself provides no defense against internal, code-level reverse engineering and tampering. A malicious cracker can step through an app’s instructions, locate the code that enforces security policies, and subsequently disable or bypass the code. Besides security policies, any sensitive business logic performed in the app is also wide open to attacks. It’s sometimes just a matter of hours to understand and compromise an app’s logic.

To ensure that your apps and policy code will do what they’re supposed to do, you will also need to “tamper-proof” them with application protection. Complementary to policy code, code protection refers to a set of special code transformations that substantially raises the bar that the attacker must overcome for success. They make code that is normally easy to understand much harder to reverse engineer. They also ensure the integrity of code by detecting and taking actions against illegitimate code changes. App protection can be applied to different areas of an app (e.g., sensitive program logic or other trade secrets) in a highly targeted manner, and in a self-defensive layered manner.

If your mobile apps perform cryptographic operations (such as RSA and AES), it’s necessary for you to further protect their cryptographic keys. If left unprotected, the keys can be extracted, therefore allowing attackers to reveal hidden, confidential data. One effective way to protect cryptographic keys and their operations is through the use of white-box cryptography, which “dissolves” the keys into their operating code making them infeasible to extract.

Together, security policies, app protection, and white-box cryptography form a very powerful, multi-layered defense against both policy and code-level threats with mobile apps. Given that these code and key protection technologies have already proven their value in the traditional desktop application space, it’s important to know about and leverage these protections against rising mobile threats in a growing app economy.