Reviewing app resilience: obfuscation, integrity and attestation
You learn to evaluate defences against reverse engineering and tampering: you measure obfuscation quality, review integrity and environment checks, set up server-side app attestation and decide whether it is enough for the threat model.
Level 401 · 21 lessons · 18 practice labs
Lessons
Where resilience fits
- The resilience threat model: who, why and with how much effort
- The MASVS resilience requirements and when they apply
- Defence in depth: why security by secrecy is not enough
- Measuring effort: how much time a control costs an attacker
- Short task: decide the resilience level needed for a banking app and a news app
Obfuscation quality
- Reviewing the R8 configuration: keep rules that are too broad
- Measuring obfuscation coverage: class and method names left readable
- Leftover debug information: source file names and log strings
- Symbols and stripping in native libraries
- Custody of the mapping file and what its leak means
- Short task: find the keep rule that defeats obfuscation and narrow it
Integrity and environment checks
- Reviewing the signature self-check: where, how often, how it reacts
- Evaluating root detection checks: the weakness of a single check
- Evaluating debugger and hook detection checks
- Designing the response: shut down or report to the server
- Short task: inventory the environment checks in a protected build and their weak points
Server-side attestation
- Reading a Play Integrity verdict: device, app and licensing fields
- Verifying the verdict on the server: nonce, signature and replay protection
- Key attestation for apps
- Short task: fix a backend that does not verify the integrity verdict and block replay
Capstone
- Capstone: write the resilience assessment report and improvement plan for a wallet app
Practice labs
- Decide the resilience level for two apps: State with reasons the level needed for a banking app and a news app.
- Tie resilience requirements to the threat model: Match five threats for the Yelkovan Bankası app to MASVS resilience items.
- Turn a secrecy-based design into server-side checks: Review a design that trusts a business rule hidden in the client and write, as a design note, which checks move to the server.
- Compare class names in protected and unprotected builds: Compare the number of readable class names in the jadx output of two APKs.
- Narrow the keep rule that defeats obfuscation: Find the rule keeping the whole package in the R8 configuration, narrow it and measure the gain in coverage.
- Measure and clean leftover debug information: Count source file names, log strings and native symbols, fix the configuration and prepare a before-and-after table.
- List the environment checks in a protected build: Find the classes that check for root access and a debugger in the code.
- Document the weakness of a single-point check: Explain with code evidence why a check returning one boolean is inadequate and propose a multi-point design.
- Inventory the checks and propose a response design: Tabulate every environment and integrity check, where it is called and how it reacts, and write a response design that reports to the server.
- Read the fields of a sample integrity verdict: Interpret the device, app and licensing fields in a decoded verdict.
- Fix a backend that does not verify the verdict: Add signature and package name verification to the lab backend and show a forged verdict is refused.
- Block replay with a nonce: Generate a single-use nonce on the server, match it to the verdict and prove by test that the same verdict is refused the second time.
- Check where the mapping file is kept: Confirm whether the mapping file is present in the release archive and inside the APK.
- Rate resilience findings by effort: Order six findings by the time they save an attacker and compare with the cost to fix.
- Write the resilience report for a wallet app: Report the obfuscation, check and server attestation findings and add a three-stage improvement plan.
- Find where the signature self-check is called: List the method that reads the app's own signature in the protected build's code and where it is called.
- Assess how the self-check stores the expected digest: Show that the expected certificate digest sits in the code as a plain string and propose a sturdier design.
- Write a design that backs the client self-check with server verification: Review the self-check's frequency, reaction and reporting to the server, report the gaps and deliver a design note that includes server-side verification.
About this course
You learn to evaluate defences against reverse engineering and tampering: you measure obfuscation quality, review integrity and environment checks, set up server-side app attestation and decide whether it is enough for the threat model.
What you will learn
- Where resilience fits
- Obfuscation quality
- Integrity and environment checks
- Server-side attestation
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.