Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Pirated mobile Android and Apple apps getting hacked, cracked and smacked

Ellen Messmer | Aug. 21, 2012
Those popular mobile apps that everyone's buying from the official Android and Apple apps stores for business and fun are being torn apart by hackers who turn around and post these abused apps filled with malware, their content pirated or otherwise tampered, according to a study out today.

With industries like financial services now making official Android and iOS apps available, there is a lot at stake for businesses to prevent their apps from becoming pirated and abused.

According to the Arxan report, it's not hard to rip up legit apps. Many free or low-cost decompilation tools and disassembly and debugging tools, such as IDA Pro, exist that would allow a hacker to reverse engineer and in many cases to translate a binary app code back into its source code. "Especially Android Java apps can be easily and trivially decompiled back to source code. Native Android and iOS apps are relatively easy to reverse-engineer as well," the Arxan study says.

While encryption can slow down the hacking process, it doesn't always stop it. "Encrypted apps can be cracked easily by hackers by getting ('dumping') the code from the device memory (where it is running in decrypted form during app execution)," the Arxan report states. This is done with hacking tools like Clutch for iOS.

Legit Apple IOS apps downloaded from the Apple App Store are digitally signed through an encryption process to indicate the owner and the Apple imprimatur -- and apps can't run on Apple devices unless they're signed. The pirated Apple apps, though, are published on third-party sites and can be used by jailbroken Apple devices.

Android apps, though not signed by Google, can be self-signed digitally by the app's owner, Arxan points out. But pirated versions of legit apps can be modified to bypass any licensing checks implemented in the code. The successful hacker can even re-sign it with his own encryption key.

In all of this, Arxan asserts its technology can be applied to compiled or binary code of apps to harden them against reverse-engineering that hackers may try. Privately held Arxan, which received national security-driven funding when in the early stages of research and development at Purdue Research Park, is said to be used by the U.S. Department of Defense today for hardening applications against tampering.



Previous Page  1  2 

Sign up for CIO Asia eNewsletters.