Lesson 9 of 9 · 5 min read
Software Protection and Its Limits
On a device the attacker controls, every check can be observed, hooked or patched. Obfuscation hides structure and constants until run time; anti-debugging and anti-tamper detect analysis and modification; guard networks make checks protect each other. Each is defeated by observing the program when it must reveal behaviour or by changing the code that checks. Their value is economic: higher cost per attack, detection at scale and time between releases. Security decisions and secrets belong on the server, backed by attestation and authorisation, so removing client protections gains an attacker nothing important.
free sign-in, no card required
Practise it as an interviewer asks it
How do apps detect rooted or jailbroken devices, why can it always be bypassed, and what should the detection actually be used for?How do encoding and payload splitting get past filters, and what does that say about filter design?How do you reverse engineer an Android or iOS app in an authorised assessment, and what does obfuscation change?A team proposes hiding an API signing key and algorithm inside a native library in their app. How would you evaluate that?A vendor sells your bank an app-shielding (RASP and obfuscation) product. How do you evaluate whether it is worth it?How is certificate pinning bypassed on a device the tester controls, what does that prove, and how do apps and backends resist?