The Essential Guide to Preventing Mobile App Repackaging

Imagine downloading your favorite app, only to discover it’s a wolf in a sheep’s clothing. This is the reality of repackaged apps – popular applications that have been tampered with to include malicious code. Cybercriminals employ sophisticated techniques to reverse engineer legitimate apps, inject their nefarious payloads, and redistribute these trojan horses to unsuspecting users.

Traditional antivirus solutions, while valuable, often fall short in detecting these threats. Their reliance on signature-based detection leaves users vulnerable to zero-day attacks lurking within repackaged apps. This is where the focus on preventing app repackaging becomes crucial.

By targeting the root of the problem – the repackaging process itself – we can potentially thwart a significant portion of Android malware before it ever reaches users’ devices. This proactive approach not only protects consumers but also safeguards the reputation and revenue of legitimate app developers.

In this blog, we’ll delve into the world of app repackaging prevention, exploring cutting-edge techniques and best practices to keep your digital life secure. Whether you’re a developer looking to protect your creations or a user seeking to fortify your defenses, understanding and combating app repackaging is your first line of defense in the mobile application security battleground.

What is App Repackaging?

App repackaging is a process where an existing Android application is reverse-engineered by cyber criminals to access its source code. The app is then modified to include malicious or unauthorized code and redistributed without the original developer’s permission, often for harmful purposes. This altered version can compromise user data, privacy, and security, making it a significant threat to both users and developers.

How Repackaging Facilitates IP Theft

Intellectual property theft involves stealing or using someone else’s creations, inventions, or proprietary information without permission. This can include:

• Patents: Protecting inventions
• Copyrights: Covering creative works like software
• Trademarks: Identifying brands and logos
• Trade Secrets: Confidential business information

Repackaging attacks are a direct form of IP theft for several reasons:

• Unauthorized Use of Code: Attackers decompile and modify the original app’s source code, which is a clear violation of the developer’s copyright. This unauthorized use of code is a theft of the developer’s intellectual property.
• Revenue Diversion: By removing ads or bypassing in-app purchases, attackers divert revenue that rightfully belongs to the original developers. This not only constitutes financial theft but also undermines the developer’s business model.
• Brand Exploitation: Repackaged apps often retain the look and feel of the original, misleading users into thinking they are using a legitimate product. This exploitation of the developer’s brand and reputation is a form of trademark infringement.
• Distribution of Modified Apps: Attackers may rebrand the app and distribute it as their own, effectively stealing the developer’s market share and user base. This can be particularly damaging for less popular apps that are repackaged to include new branding and advertising, generating revenue for the attacker instead of the original developer.

Why Prevent App Repacking in Android Apps??

There are several important reasons to prevent app repackaging in Android apps:

1. Protect against malware distribution: Repackaging is a common technique used by malware creators to inject malicious code into legitimate apps. By preventing repackaging, developers can significantly reduce the risk of their apps being used as vehicles for malware distribution.
2. Preserve app authenticity and integrity: Repackaging alters the original app code, compromising its authenticity and potentially introducing vulnerabilities or unwanted functionality.
3. Maintain revenue streams: Repackaged apps can bypass in-app purchases, remove or redirect ad revenue, or distribute paid apps for free, causing financial losses for legitimate developers.
4. Protect user data and privacy: Repackaged apps may include code to steal user credentials, financial information, or other sensitive data.
5. Comply with app store policies: Many app stores, including Google Play, have policies against repackaged apps. Preventing repackaging helps ensure compliance with these policies.
6. Reduce piracy: Repackaging is a common method for app piracy, allowing attackers to distribute paid apps for free or modify free apps to generate revenue for themselves. 

Repackaging Attacks Getting Over The Top 

Repackaging attacks are not limited to a single category; they affect everything from financial services to gaming apps. One particularly vulnerable category is over-the-top (OTT) video apps. These apps, which provide streaming services, are prime targets due to their broad user base and the high value of their content. 

Let’s delve into the specifics of how repackaging affects OTT video apps and the techniques attackers use to exploit them.

Repackaging an OTT video app involves several steps that attackers meticulously follow to exploit the app’s popularity and user trust. Here’s a detailed look at the process:

1. Target Selection
   Attackers often choose popular OTT video apps due to their extensive user base and potential for financial gain. These apps are particularly attractive because users frequently seek out modified versions that offer premium features for free.

2. Obtaining the Original App
   The attacker downloads the legitimate OTT app from an official app store or acquires the APK (Android Package Kit) file through other means.

3. Decompilation
   Using freely available tools, the attacker decompiles the app to access its source code, resources, and assets.

4. Code Analysis and Modification
   The attacker analyzes the decompiled code to understand its structure and functionality. They then make modifications, which may include:
   Removing Advertisements: Stripping out ads to make the app more appealing to users.
   Bypassing Subscription Checks: Allowing free access to premium content.
   Disabling DRM Protections: Removing digital rights management to enable unauthorized content distribution.
   Inserting Malicious Code: Embedding spyware or other malicious components to steal user data.

5. Repackaging
   The modified code and resources are recompiled into a new APK file.

6. Resigning
   The attacker signs the repackaged app with their own certificate, making it appear as a legitimate update or different version of the original app.

7. Distribution
   The repackaged app is distributed through various channels:
   Unofficial App Stores: Platforms that do not enforce strict security measures.
   File-Sharing Websites: Sites where users can download APK files directly.
   Phishing Campaigns: Emails or messages that trick users into downloading the malicious app.
   Social Media: Posts or ads promoting the modified app.

8. User Deception
   Users are lured into downloading the repackaged app through promises of free premium features or ad-free experiences. The modified app often looks and functions similarly to the original, making it difficult for users to detect the difference.

9. Consequences
   Revenue Loss: The original developers lose advertising revenue and potential subscription fees.
   Data Theft: User credentials and personal information may be stolen.
   Brand Damage: If the repackaged app is associated with malicious activity, it can severely damage the reputation of the original OTT service.
   Intellectual Property Theft: The attacker benefits from the original developer’s work and investments.

10. Ongoing Threat
    Repackaging is not a one-time event. Attackers often update their repackaged apps to keep up with official updates, maintaining the illusion of legitimacy and continuing to exploit users over time.

Prerequisites to Prevent App Repacking:

• AppSealing account – You need to create an account on AppSealing mobile app security build system.
• License for Prevent App Repacking feature – You need to have a license to use this specific feature on AppSealing.
• Mobile App file – You need the original Android app file (.apk or .aab format) that you want to protect.
• Signing Credentials – You need valid signing credentials to sign the protected app after the repackaging prevention is applied. Ideally, you should use the same signing certificate that was used to sign the original app.
• Development Environment – You need a Windows computer to run AppSealing.
• Understanding of the App – You should have knowledge of the app’s structure and functionality to ensure the protection doesn’t interfere with its normal operation.
• Backup of Original App – It’s recommended to keep a backup of the original app before applying any protection.
• Latest Version of Protection Tools – Ensure you’re using the latest version of AppSealing platform or any other anti-repackaging solution you choose.
• Compliance with App Store Policies – Make sure the anti-repackaging measures comply with the policies of the app stores where you plan to distribute the app.

How to Prevent App Repacking without an SDK or gateway

To prevent app repackaging without relying on an SDK or gateway, developers can implement several robust security measures. Here are the key techniques:

1. Code Obfuscation: Obfuscation makes the app’s code difficult to read and understand, even if an attacker decompile the APK. Tools like ProGuard and R8 can be used to obfuscate the code, making it harder for attackers to identify and modify critical parts of the app.  However, there are tools available that can easily de-obfuscate these. And hence a need for obfuscation with other layers of app code protection are required.
2. Integrity Checks: Implement runtime integrity checks to ensure the app’s code has not been tampered with.
   This can include:

• Checksum Verification: Calculate and verify checksums of critical files or code sections at runtime.
• Signature Verification: Ensure the app’s signing certificate matches the original developer’s certificate during runtime.

3. Native Code Integration: Move critical security checks and sensitive code to native code (C/C++). Native code is more challenging to reverse-engineer compared to Java bytecode. This can be achieved using the Java Native Interface (JNI).
4. Encryption: Encrypt sensitive parts of the app, including resources and critical code sections. Decrypt these parts only when necessary during runtime. This adds an additional layer of mobile app security, making it harder for attackers to access and modify the app’s content.
5. Anti-Tamper Techniques: Incorporate anti-tamper mechanisms that detect unauthorized modifications.
   These can include:

• Self-Verification: The app can periodically verify its own integrity and shut down or alert the user if tampering is detected.
• Guard Clauses: Insert multiple guard clauses throughout the code that check for integrity and consistency. If any guard clause detects tampering, it can trigger a response such as terminating the app.

6. Secure Communication: Ensure all data transmissions between the app and backend servers are encrypted using SSL/TLS. Implement certificate pinning to prevent man-in-the-middle attacks.
7. Watermarking: Use watermarking techniques to embed unique identifiers within the app’s code. This can help in tracking and identifying repackaged versions of the app.
8. Monitoring and Analytics: Integrate monitoring tools to track app usage and detect anomalies that may indicate repackaging attempts. This can include unusual patterns of app distribution or unexpected behavior in the app’s usage.
9. Frequent Updates: Regularly update the app with new security measures and patches. Frequent updates make it harder for attackers to keep up with the changes and exploit vulnerabilities.

Conclusion:

Android app repackaging poses significant threats to both users and developers, including malware distribution, intellectual property theft, revenue loss, and brand damage. Attackers reverse-engineer legitimate apps, inject malicious code, and redistribute these altered versions, often deceiving users into downloading them. AppSealing implements measures to prevent attackers from using debugging tools to analyze the app’s behavior and exploit vulnerabilities. AppSealing implements code obfuscation, RASP security, Anti-Debugging, Anti-Code Tampering, Secure Data Storage and Communication to secure apps from being repackaged.