M07: Insufficient Binary Protections

📋 What Is It?

Insufficient Binary Protections occurs when mobile applications lack protection against reverse engineering, tampering, and code modification. This includes missing obfuscation, no anti-debugging measures, absent root/jailbreak detection, and lack of integrity verification. Since mobile binaries are distributed to users, they're vulnerable to analysis and modification.

M07 OWASP Rank

89% Apps Unprotected

<4hrs Time to Reverse

⚠️ Common Exploits

Binary Decompilation: Extract source code from APK/IPA
Code Injection: Modify app logic and repackage
Runtime Manipulation: Hook methods with Frida/Xposed
License Bypass: Remove payment verification
Debugger Attachment: Step through code execution
Memory Tampering: Modify values in runtime memory

🔴 Attack Flow

1. Download APK from Google Play
↓
2. Decompile with jadx or apktool
↓
3. Modify premium check: return true
↓
4. Repackage and sign with new certificate
↓
5. BREACH: Premium features unlocked!

❌ Vulnerable Code

// Bad: No obfuscation (Android)
// build.gradle
buildTypes {
    release {
        // VULNERABLE: ProGuard disabled
        minifyEnabled false
        shrinkResources false
    }
}

// Bad: No root detection (Android)
public boolean isPremiumUser() {
    // VULNERABLE: Easy to bypass with Frida
    return prefs.getBoolean("isPremium", false);
}

// Bad: No integrity check (Android)
public void onCreate() {
    // VULNERABLE: No signature verification
    // App can be modified and re-signed
    initializeApp();
}

// Bad: Clear license check (iOS)
func hasValidLicense() -> Bool {
    // VULNERABLE: Easy to find and patch
    let license = UserDefaults.standard.string(forKey: "license")
    return license == "PREMIUM_USER"
}

// Bad: No debugger detection
public void processPayment() {
    // VULNERABLE: Can be debugged and analyzed
    if (validateCreditCard()) {
        completeTransaction();
    }
}
                

✅ Secure Code

// Good: Enable obfuscation (Android)
// build.gradle
buildTypes {
    release {
        // Enable ProGuard/R8 obfuscation
        minifyEnabled true
        shrinkResources true
        proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
                      'proguard-rules.pro'
    }
}

// Good: Root/jailbreak detection (Android)
public boolean isDeviceSecure() {
    // Check for root indicators
    if (checkRootFiles() || checkSuBinary() || checkRootApps()) {
        Log.w("Security", "Rooted device detected");
        showSecurityWarning();
        return false;
    }
    
    // Check SafetyNet attestation
    return verifySafetyNetAttestation();
}

private boolean checkRootFiles() {
    String[] paths = {
        "/system/app/Superuser.apk",
        "/sbin/su",
        "/system/bin/su",
        "/system/xbin/su"
    };
    
    for (String path : paths) {
        if (new File(path).exists()) {
            return true;
        }
    }
    return false;
}

// Good: Integrity verification (Android)
public boolean verifyAppIntegrity() {
    try {
        // Check app signature matches original
        PackageInfo packageInfo = getPackageManager()
            .getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);
        
        Signature[] signatures = packageInfo.signatures;
        for (Signature signature : signatures) {
            String currentSignature = sha256(signature.toByteArray());
            if (!currentSignature.equals(EXPECTED_SIGNATURE)) {
                // App has been tampered with
                return false;
            }
        }
        return true;
    } catch (Exception e) {
        return false;
    }
}

// Good: Debugger detection (Android)
public boolean isDebuggerAttached() {
    // Check if debugger is connected
    if (Debug.isDebuggerConnected()) {
        return true;
    }
    
    // Check debug flag in ApplicationInfo
    int flags = getApplicationInfo().flags;
    return (flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0;
}

// Good: Jailbreak detection (iOS)
func isJailbroken() -> Bool {
    #if targetEnvironment(simulator)
        return false
    #else
        // Check for jailbreak files
        let paths = [
            "/Applications/Cydia.app",
            "/Library/MobileSubstrate/MobileSubstrate.dylib",
            "/bin/bash",
            "/usr/sbin/sshd",
            "/etc/apt"
        ]
        
        for path in paths {
            if FileManager.default.fileExists(atPath: path) {
                return true
            }
        }
        
        // Try to write to protected location
        let testPath = "/private/test.txt"
        do {
            try "test".write(toFile: testPath, atomically: true, encoding: .utf8)
            try? FileManager.default.removeItem(atPath: testPath)
            return true  // Should not be able to write
        } catch {
            return false
        }
    #endif
}

// Good: Frida detection
public boolean isFridaRunning() {
    // Check for Frida server ports
    int[] fridaPorts = {27042, 27043};
    for (int port : fridaPorts) {
        if (isPortOpen(port)) {
            return true;
        }
    }
    
    // Check for Frida libraries
    try {
        for (String lib : new File("/proc/self/maps").list()) {
            if (lib.contains("frida")) {
                return true;
            }
        }
    } catch (Exception e) {}
    
    return false;
}
                

✓ Prevention Checklist

Enable code obfuscation (ProGuard/R8/DexGuard)
Implement root/jailbreak detection
Add debugger detection checks
Verify app signature/integrity at runtime
Implement anti-tampering measures
Use string encryption for sensitive values
Detect emulators and virtualized environments
Implement Frida/Xposed framework detection
Use native code (C/C++) for critical logic
Consider commercial RASP solutions for high-value apps

🔍 Detection & Tools

Attack Tools:

jadx apktool Frida Xposed Hopper IDA Pro Ghidra

Protection Tools:

ProGuard R8 DexGuard iXGuard SafetyNet RootBeer AppSealing

How to Test:

Decompile APK with jadx and review code readability
Test on rooted/jailbroken device for detection
Attach debugger (Android Studio, lldb) and verify detection
Use Frida to hook methods and check for detection
Repackage app and verify signature checks
Test on emulators for detection mechanisms

🌍 Real-World Impact

Gaming Apps: In-app purchase bypasses costing millions in revenue
Banking Apps: Transaction modification on unprotected binaries
Streaming Apps: License checks bypassed, premium content unlocked
Fitness Apps: Premium features unlocked via simple patching
Messaging Apps: E2E encryption bypassed through code modification

📌 Quick Tips

DO NOT rely solely on client-side protections
DO NOT store business logic only in mobile app
DO enable code obfuscation for all releases
DO implement multiple defense layers
DO verify app integrity at runtime
DO use native code for critical operations

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.3.2
OWASP MASVS MSTG-RESILIENCE-1 to 11
NIST 800-53 SA-10
ISO 27001 A.14.2.5
App Store Anti-Piracy Guidelines

🛡️ Insufficient Binary Protections