MASVS-RESILIENCE – Resilience Against Reverse Engineering and Tampering

OWASP MASVS 2.1.0 – MASVS-RESILIENCE – Resilience Against Reverse Engineering and Tampering

1.Kravtext (engelskt original)#

Defense-in-depth measures such as code obfuscation, anti-debugging, anti-tampering, etc. are important to increase app resilience against reverse engineering and specific client-side attacks. They add multiple layers of security controls to the app, making it more difficult for attackers to successfully reverse engineer and extract valuable intellectual property or sensitive data from it, which could result in:

The theft or compromise of valuable business assets such as proprietary algorithms, trade secrets, or customer data
Significant financial losses due to loss of revenue or legal action
Legal and reputational damage due to breach of contracts or regulations
Damage to brand reputation due to negative publicity or customer dissatisfaction

The controls in this category aim to ensure that the app is running on a trusted platform, prevent tampering at runtime and ensure the integrity of the app’s intended functionality. Additionally, the controls impede comprehension by making it difficult to figure out how the app works using static analysis and prevent dynamic analysis and instrumentation that could allow an attacker to modify the code at runtime.

However, note that the lack of any of these measures does not necessarily cause vulnerabilities - instead, they add threat-specific additional protection to apps which must also fulfil the rest of the OWASP MASVS security controls according to their specific threat models.

MASVS-RESILIENCE-1#

The app validates the integrity of the platform.

Running on a platform that has been tampered with can be very dangerous for apps, as this may disable certain security features, putting the data of the app at risk. Trusting the platform is essential for many of the MASVS controls relying on the platform being secure (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted.

MASVS-RESILIENCE-2#

The app implements anti-tampering mechanisms.

Apps run on a user-controlled device, and without proper protections it’s relatively easy to run a modified version locally (e.g. to cheat in a game, or enable premium features without paying), or upload a backdoored version of it to third-party app stores. This control tries to ensure the integrity of the app’s intended functionality by preventing modifications to the original code and resources.

MASVS-RESILIENCE-3#

The app implements anti-static analysis mechanisms.

Understanding the internals of an app is typically the first step towards tampering with it (either dynamically, or statically). This control tries to impede comprehension by making it as difficult as possible to figure out how an app works using static analysis.

MASVS-RESILIENCE-4#

The app implements anti-dynamic analysis techniques.

Sometimes pure static analysis is very difficult and time consuming so it typically goes hand in hand with dynamic analysis. Observing and manipulating an app during runtime makes it much easier to decipher its behavior. This control aims to make it as difficult as possible to perform dynamic analysis, as well as prevent dynamic instrumentation which could allow an attacker to modify the code at runtime.