The good news here is that, unless your android license key password is easily guessable, or if you give it out to someone else, the attacker will not be able to publish an application with the same license key. Lastly, the paper linked above, as well as numerous scholarly articles and online blogs describe how, once the source code (or even obfuscated source code) is leaked, once can merely add some of their own, malicious code, resign the app, and publish it on the Android Market. A detailed HOW-TO for how to crack it (pre-Google Play) is available here. Unfortunately, LVL is also not entirely secure. To protect agains illegally copy and distribution of your application, Google Play provides some licensing options.
In order to prevent your important code from being read, however, you will need to move all vulnerable methods or variables to a file that is not an Activity, Service, or BroadcastReceiver. Proguard is a tool provided by Android that lets you obfuscate (make harder to read) your code during packaging. The good news is that you can obfuscate the important pieces of your code making it harder to reverse engineer. Someone with a will can always view your sourcecode if they get a copy of your apk (easily available on a rooted phone). You will not be able to block this from happening to your app.
I explain each below and way to solve them.įirstly, this paper describes how to reverse-engineer an Android application by unpacking the compiled code and viewing the source code. The biggest threats agains an app on the Android Market include leaked source code, copied/distributed paid apps, and re-keying. I released a free anti-malware app for Android, and making sure nobody hacked it was essential to its success.
0 kommentar(er)
