Protecting million-user iOS apps with obfuscation: motivations, pitfalls, and experience

摘要: In recent years, mobile apps have become the infrastructure of many popular Internet services. It is now fairly common that a app serves large number users across globe. Different from web-based services whose important program logic mostly placed on remote servers, require complicated client-side code to perform tasks are critical businesses. The can be easily accessed by any party after software installed rooted or jailbroken device. By examining code, skilled reverse engineers learn various knowledge about design and implementation an app. Real-world cases shown disclosed information allows malicious parties abuse exploit app-provided for unrightful profits, leading significant financial losses vendors. One most viable mitigations against engineering obfuscate before release. Despite security obscurity typically considered unsound protection methodology, obfuscation indeed increase cost engineering, thus delivering practical merits protecting apps. this paper, we share our experience applying multiple commercial iOS apps, each which has millions users. We discuss necessity adopting modern business, challenges platform, efforts in overcoming these obstacles. Our report benefit stakeholders ecosystem, including developers, service providers, Apple as administrator ecosystem.