Posts

Showing posts with the label Malware

Code Obfuscation

When it comes to security of an application, Source code piracy is one of the major concerns. If your source code is available to hackers, it means you are totally screwed. Hackers can then easily bypass your applied security controls, re-build application with malicious code snippets and also misuse the business logic used in the application. Obfuscation is the process of renaming the meta-data in an Assembly so that it is no longer useful to a hacker, but remains usable to the machine for executing the intended operations. It does not modify the actual instructions or mask them from observation by a hacker. Reverse engineering of your proprietary applications by unfair competition or malicious hackers may result in highly undesirable exposure of your algorithms and ideas, proprietary data formats, licensing and security mechanisms, and, most importantly, your customers' data. Getting into more details about Code Obfuscation as given below. Name Obfuscation: Na...

Strict SSL Pinning

Image
What is SSL pinning? Why do we need SSL pinning in mobile applications? How to do it? SSL pinning means hard-coding the certificate known to be used by the server in the mobile application. The app can then ignore the device’s trust store and rely on its own, and allow only SSL connections to hosts signed with certificates stored inside the application. This also gives a possibility of trusting a host with a self-signed certificate without the need to install additional certificates on the device.  SSL Pinning on Android: Simplest Way PROS of Certificate Pinning: Increased security  - with pinned SSL certificates, the app is independent of the device’s trust store. Compromising the hard coded trust store in the app is not so easy - the app would need to be decompiled, changed and then recompiled again - and it can’t be signed using the same Android keystore that the original developer of the app used. Reduced costs  - SSL certificate pinning gives you ...

Mobile Malwares you should Watchout for

Most affecting and Active Malwares on Mobile Devices: DangerousObject.Multi.Generic Trojan-SMS.AndroidOS.OpFake.bo AdWare.AndroidOS.Ganlet.a Trojan-SMS.AndroidOS.FakeInst.a RiskTool.AndroidOS.SMSreg.cw Trojan-SMS.AndroidOS.Agent.u Trojan-SMS.AndroidOS.OpFake.a Trojan.AndroidOS.Plangton.a Trojan.AndroidOS.MTK.a AdWare.AndroidOS.Hamob.a Android.Geinimi SMS.AndroidOS.FakePlayer.c Android.DroidDream AKA Android.Rootcager AKA AndroidOS_Lootoor.A Android.BgServ AKA Troj/Bgserv-A AKA AndroidOS_BGSERV.A Android.KungFu Variants More are here: AegisLab, Andr/Plankton-A, Andr/SMSRep-B/C, Android, Android Market, Android OS, Android.Adrd, Android.Adrd.A, Android.Adsms, Android.Basebridge, Android.Bgserv, Android.DroidDream, Android.Fokonge, Android.Geinimi, Android.GGTracker, Android.Gunfu, Android.Hippo, Android.HippoSMS, Android.HongTouTou, Android.Jsmshider, Android.LightDD, Android.Lovetrap, Android.NickiBot, Android.Nickispy, Android.Pja...