APK - Where is the security?

Question

I read this regarding how to extract code from apk.

I am really confused how does other app ensures security. I have a website. In that I have written all queries in PHP. So There is no way to get my queries unless they compromise my server.

In case of android app, I will have to write all the queries, connection details in Java. So when they can able to get code from APK, they can get my credentials. Isn't?

How does other app work? If I understood wrongly, please help me to understand.

Check out my answer on a similar question: [hiding strings in Obfuscated code](http://stackoverflow.com/questions/4427238/hiding-strings-in-obfuscated-code/39856033#39856033) — Efra Espada, Nov 17 '16 at 16:50

score 3 · Answer 1 · answered Apr 03 '16 at 15:33

So when they can able to get code from APK, they can get my credentials. Isn't?

Yes. If your app contains secrets and you distribute it to your customer, you customer has the secret.

Whilst you can obscure the secret using obfusctation tools like Proguard, his will be of limited effectiveness again all but the most casual attacker.

How does other app work?

Usually, the client-side app makes a connection to a front-end application on your server. The application server does its own identity management, connects to the database, and performs whatever limited range of operations the application allows for each user.

The application server is typically accessed using some kind of web services. You can re-use your PHP code here; the client app is then effectively just a convenient interface to making HTTP calls against your existing web site.

Thanks. Do you mean REST like thing? Get JSON response from server and manipulate it at android front end side?? — Gibbs, Apr 03 '16 at 16:00
Yes, REST and JSON, with some kind of account authentication step for non-public resources, would be typical. — bobince, Apr 04 '16 at 21:30

Himanshu Shekher Jha · Answer 2 · 2016-04-03T08:21:27.387

1

Android has a feature Pro guard. Pro guard convert all String and Const value into Obfuscated code. It also remove unused files. So by using pro guard, You will get two benefit. First You get your code security. Second, Apk size reduce to 25%.

edited Apr 03 '16 at 08:21

answered Apr 03 '16 at 07:07

Himanshu Shekher Jha

1,334
2
14
27

Let me try this. So nobody can get actual string from hex? They can convert hex to string. isn't? – Gibbs Apr 03 '16 at 07:08
Well, You are right. I used hax word anonymously. I edited my answer after some research about that format. – Himanshu Shekher Jha Apr 03 '16 at 08:22

score 0 · Answer 3 · edited Mar 03 '18 at 20:31

0

Save your queries in res/string.xml file and use Proguard. Do not write queries in Java, just use the string in string.xml as query.

edited Mar 03 '18 at 20:31

halfer

19,824
17
99
186

answered Apr 03 '16 at 07:33

erluxman

18,155
20
92
126

APK - Where is the security?

3 Answers3