Software Protection on the Go: A Large-Scale Empirical Study on Mobile App Obfuscation
Software Protection on the Go: A Large-Scale Empirical Study on Mobile App Obfuscation
复制标题
DOI：
10.1145/3180155.3180169
复制
发表时间：
2018-05
期刊：
影响因子：
--
通讯作者：
Pei Wang;Qinkun Bao;Li Wang;Shuai Wang;Zhaofeng Chen;Tao Wei;Dinghao Wu
中科院分区：
文献类型：
--
作者：
Pei Wang;Qinkun Bao;Li Wang;Shuai Wang;Zhaofeng Chen;Tao Wei;Dinghao Wu
智能手机市场的繁荣引发了人们对移动平台软件安全的新担忧，导致对有效的软件混淆技术的需求日益增长。由于移动和桌面生态系统之间的各种差异，模糊处理在应用于移动软件时既面临技术挑战，也面临非技术挑战。虽然已经有相当多的软件安全解决方案提供商推出了他们的移动应用混淆服务，但目前尚不清楚现实世界中的移动开发人员如何将混淆作为其软件工程实践的一部分。本文的研究是系统研究软件混淆技术在移动软件开发中的应用的第一步。在一种自动化但粗粒度的方法的帮助下，我们计算了从Apple App Store抓取的100多万个应用程序样本被混淆的可能性。然后，我们检查了前6600个实例，并设法确定了539个iOS应用程序的601个模糊版本。通过大量人工分析这个样本集，我们进行了各种观察，揭示了现实世界中移动混淆的现状，为了解和改进移动平台上的软件保护情况提供了见解。
The prosperity of smartphone markets has raised new concerns about software security on mobile platforms, leading to a growing demand for effective software obfuscation techniques. Due to various differences between the mobile and desktop ecosystems, obfuscation faces both technical and non-technical challenges when applied to mobile software. Although there have been quite a few software security solution providers launching their mobile app obfuscation services, it is yet unclear how real-world mobile developers perform obfuscation as part of their software engineering practices. Our research takes a first step to systematically studying the deployment of software obfuscation techniques in mobile software development. With the help of an automated but coarse-grained method, we computed the likelihood of an app being obfuscated for over a million app samples crawled from Apple App Store. We then inspected the top 6600 instances and managed to identify 601 obfuscated versions of 539 iOS apps. By analyzing this sample set with extensive manual effort, we made various observations that reveal the status quo of mobile obfuscation in the real world, providing insights into understanding and improving the situation of software protection on mobile platforms.