1

I'm starting a new project in the coming weeks but I have some questions related to the "design" of the app.

The app will be a server + database that talks to an Android app that also has it's own database (for offline use).

The connection will be used to exchange strings that are encrypted with a custom "protocol" (game network protocol encapsulated in TLS). This means that the app would have two layers of security :

  1. TLS -> against MitM attacks
  2. Custom protocol -> against "in-game hacks", like game packet tampering

My questions are the following :

  • Is it possible to use TLS between node.js and Android ? Are there any good links on that subject ?

(I read there were some issues with the format of the certs that was different in java and node.js. It was related to OpenSSL and the EVP_BytesToKey function)

-- > Encrypt with Node.js Crypto module and decrypt with Java (in Android app)

--> http://olabini.com/blog/tag/evp_bytestokey/

  • Is there a way of obfuscating the source code of the Android app so that the custom "protocol" can be decrypted client-side safely? Or should all the magic take place server side ?

(I don't want the decryption source-code to be visible for users to dissect the custom protocol and start developing hacks.)

  • Any tips or links on increasing the security of my node.js server in general ?

(I heard some people talking about Nginx proxies, but since I'm not serving webpages does it still make sense ? Wouldn't it overload the server ?)

Thank you alot in advance !

Community
  • 1
  • 1
m_vdbeek
  • 3,704
  • 7
  • 46
  • 77

1 Answers1

1

(In)Security though obscurity does not solve the real security problems you face. What you are describing is not how games protect themselves from attack. SSL/TLS does prevent against MITM attacks, however your attacker isn't just a MITM, he is a user of your software. If the app can make the SSL/TLS connection, then the attacker can also make this connection and should assume that the attacker will always full access to the API you provide.

Cryptography cannot solve CWE-602: client side enforcement of server side security. A database merge between the client's offline database and the server is trusting the client's data, and there for a violation of CWE-602. In this attack the attacker doesn't need access to the API, he could just modify the sqlite database locally.

rook
  • 66,304
  • 38
  • 162
  • 239