12

Looking at some postings at stackoverflow, as of writing, there seems to be really no way to effectively prevent app piracy.

is anyone here actually losing money from app piracy? what's your current solution (free or non-free) against app crackers?

what are some of the popular & reliable solutions for protecting enterprise level apps?

user1299068
  • 121
  • 1
  • 4

2 Answers2

7

Use the LVL (License Verification Library) provided via Google, its a server side verification that the user actually bought your app.

http://developer.android.com/guide/market/licensing/index.html

Use other techniques to detect if you application has been tampered with, there are a few and they are covered in this blog post and the I/O video. Assume it was pirated if tampered with. (Double extra check to make sure you don't mess this up and annoy real users)

http://android-developers.blogspot.com/2010/09/securing-android-lvl-applications.html

http://www.youtube.com/watch?v=TnSNCXR9fbY

Use AntiLVL against your own application, attack it like a cracker! This is actually really fun and educational, see how much work it takes to crack your app. The blog/tool go over the known weaknesses and you can make some educated decisions about how to stop the automated tools from working. Stopping dedicated pirates is no ones priority, but stopping people from using a 1-click tool is easily obtainable.

http://androidcracking.blogspot.com/

EDIT 1:

Make a free version with ads and/or less features. Crackers just want free stuff, so make it easy on them :) If you detect they are using a cracked version of your paid app you can try and convert them to using the free version or upsell them to the paid version. Currently about 1/4 of the people cracking one of my apps will open the Google Play for the full paid version (although less actually buy it)

smith324
  • 13,020
  • 9
  • 37
  • 58
  • As a newcomer to the topic of Android hardening have you seen anything else what would help. I am finding that among security circle people just don't talk, so I can appreciate that if you can't discuss more detailed approaches. But this question is should I be looking further or not based on the time between this answer and now. – Hunter-Orionnoir Dec 22 '14 at 00:14
3

This google IO 2011 video should be your bible: Evading Pirates and Stopping Vampires using License Verification Library, In-App Billing, and App Engine

It talks about many things you can do to defend yourself.

Pedro Loureiro
  • 11,436
  • 2
  • 31
  • 37
  • And as far as I can tell all these points mentioned are still ways of slowing down the piracy. As long as you massively customize the LVL and IAB portions that you implement. A lot of these points hold true. I just don't think this is the entire approach too. – Hunter-Orionnoir Dec 22 '14 at 00:06