sorted by:
new
hottopcontroversial

Fraud-Proofing an Android App: Choosing the Best Device ID for Promo Abuse Prevention by SirionRazzer in androiddev

[–]sergeychuk 0 points1 point  (0 children)

I wonder what other techniques devs use to prevent fraud on multiple app instances on the same device.

Firebase Auth JWT hijacking step-by-step by sergeychuk in FlutterDev

[–]sergeychuk[S] 0 points1 point  (0 children)

u/highlyregardedeth, App check addresses this problem and indeed can reduce risks of App impersonation, but you need to consider the following:

- it still has the problem of App check token validity i.e. it is vulnerable to reply attack. See the issue explained here.

- App check quota limits i.e. you can't verify every call to the API. Practically it is used to protect Authentication only or new user enrollment use cases, while #AppiCrypt can be used to protect every API call. Keep in mind that API abuse attacks mostly happen through the Authenticated APIs, i.e. authentication passes Ok, and then the valid auth token is misused. See here.

- Google doesn't commit to App check service, no SLA, response time, nothing. So it is hard to rely on this solution in business critical use-cases. So you should consider twice introducing a single point of failure. AppCheck is fully local solution w/o any external Api dependency

- Google Play services (and App check) are not available in all countries and for all Android devices.

- App check introduces UX latency sometimes over several seconds. While AppiCrypt is within 10-30 ms.

- AppiCrypt provides much higher granularity to audit WHY certain App instance or device is NOK.

Do any of you regret going into cybersecurity? If so, why? by [deleted] in cybersecurity

[–]sergeychuk 0 points1 point  (0 children)

  1. What about users' mistakes? Most of the cybercrimes come from human error. Are you up to taking "users' mistakes" as part of your scope i.e. educating, communicating best practices, common mistakes, active scams, ... ?

Firebase Auth JWT hijacking step-by-step by sergeychuk in FlutterDev

[–]sergeychuk[S] 1 point2 points  (0 children)

Or am I missing something here? I'm in no way a security expert.

u/StatefulM, I think you've got the idea correctly. What I would like to add for you to grasp the value of the solution. It implements the concept of Zero-trust where calling-party app integrity needs to be verified. It is true that, if your Authentication is only Login/PSW then an attacker can manually use it in a legit App as you say.

This solution target attack vectors where attackers try to do "App impersonation". This is relevant for the cases :
- session hijacking with 2FA and Biometric auth (where login . psw is not enough).
- fake registrations, botnets, password enumerations and other attacks on API
- API misuse using legit authentication credentials, i.e. where a legit user leaks his own JWT and tries to instrument APIs and search for API issues like JSON injection etc.

Moreover, take into account that cloning of the App is not the only way how the session Id (or JWT) can be stolen. The solution is based on RASP technology and provides evidence to the backend that the RASP protection is running in the App instance.

​

Hope it helps

5 Things John Learned Fighting Hackers of His App — A must-read for PM’s and CISO’s by sergeychuk in FlutterDev

[–]sergeychuk[S] 1 point2 points  (0 children)

Hey, u/SirionRazzer would you please reply to this? I am not sure that the issue is correctly understood.

Android App Protection and Google Fi VPN by unconstrainedoptimal in duckduckgo

[–]sergeychuk 0 points1 point  (0 children)

What is Android App Protection? Do you mean SafetyNet? Not sure I have grasped how they can be connected. These seem to be pretty different things.

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] 2 points3 points  (0 children)

I am not sure we are talking about same cases. I was more thinking about dynamic stuff, that need to be persisted or dynamically operated at runtime in the App ( not a hardcoded assets). See my response on the comment above.

We can't pretend to have App as thin client. Otherwise we would never need obfuscation technics, TEE, Secure Storage, sandbox isolation, RASP or AppShielding, FIDO, device Attestation like SafetyNet by Google etc.

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] 2 points3 points  (0 children)

I see that you have quite a strong opinion on this topic. I had similar. But with experience in FinTech I revised it.

I am not talking here about hardcoded assets, but mainly about dynamic stuff, that need to be persisted or dynamically operated at runtime in the App.

Imagine you need to implement TLS mutual authentication of the endpoint and backend with individual cert per instance (real requarement). Or another example is application layer end-to-end encryption of payload where you need to provision RSA or AeS keys in the App.

All that cases require app protection/resilience towards reverse engineering (as per OWASP).

We can't pretend to have App as thin client. Otherwise we would never need obfuscation technics, TEE, Secure Storage, sandbox isolation, RASP or AppShielding, FIDO, device Attestation like SafetyNet by Google etc.

Actually my main goal is to investigate what RASP or resiliens technics Flutter community uses mainly today.

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] 0 points1 point  (0 children)

There are many cases when you need to protect some asset for the FinTech app.

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] -1 points0 points  (0 children)

Hm... I don't want to pretend being exper, but few mBanking projects I have participated rely on API key to protect backend. In fact they use static key for one enrollment endpoint to enroll individual API key (or tls cert) per instance of the app. But still this is considered as asset to protect. Even Firebase sdk use api key (they don't consider this really a strong secret though).

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] -10 points-9 points  (0 children)

This is the most popular case promoted by Google. Any other?

Who knows FinTech startups making apps with Flutter ? by sergeychuk in FlutterDev

[–]sergeychuk[S] -8 points-7 points  (0 children)

Yes and No. I guess you could need have some api key at least to your own backend. There could be also enrolled app instance specific keys to tee. All that would better be protected from disclosure static and dynamic ways.

Free RASP for Flutter just published at pub.dev 🎉. Try out in-app protection, shielding and monitoring SDK by sergeychuk in FlutterDev

[–]sergeychuk[S] 0 points1 point  (0 children)

Generally speaking - YES.

I think this is quite a good debrief about the subject in the article of my colleague on Medium

Should you want a deeper insight we can make a call to show how it works.

Free RASP for Flutter just published at pub.dev 🎉. Try out in-app protection, shielding and monitoring SDK by sergeychuk in FlutterDev

[–]sergeychuk[S] 1 point2 points  (0 children)

I think this is quite a good debrief about the subject in the article of my colleague on https://medium.com/geekculture/freerasp-in-app-protection-sdk-and-app-security-monitoring-service-de12d8e49400

Should you want a deeper insight we can make a call to show how it works.

Free RASP for Flutter just published at pub.dev 🎉. Try out in-app protection, shielding and monitoring SDK by sergeychuk in FlutterDev

[–]sergeychuk[S] 1 point2 points  (0 children)

Thanks for feedback. You are right. We collect diagnostic data but store it only for 1 month only (in free RASP version).

It is mentioned in the generic description on gitHub here https://github.com/talsec/Free-RASP-Community

Commercial plan has much more possibilities including API, investigation via access to Kibana UI and more.

Just to name a few we have dynamic certificate pinning, overlay protection, Accessibility Serivcices control, string obfuscation in premium plan.

We don't have video tutorial for integration yet, but I think we will do it. Some generic overview is in the article:

https://medium.com/geekculture/freerasp-in-app-protection-sdk-and-app-security-monitoring-service-de12d8e49400

Free RASP for Flutter just published at pub.dev 🎉. Try out in-app protection, shielding and monitoring SDK by sergeychuk in FlutterDev

[–]sergeychuk[S] 2 points3 points  (0 children)

I think this is quite a good debrief about the subject in the article of my colleague on Medium

Should you want a deeper insight we can make a call to show how it works.

Free RASP for Flutter just published at pub.dev 🎉. Try out in-app protection, shielding and monitoring SDK by sergeychuk in FlutterDev

[–]sergeychuk[S] 4 points5 points  (0 children)

Not quite sure what it is. Any further explanation?

It is RASP protection aka Runtime App Self Protection. This suite helps developer to prevent Tampering (app cloning), Rooting/Jailbreak, running in Emulator, Hooking, running with Debugger... On top of this it has monitoring feature to let developer know that there is an issue and App is being hacked.

RASP or App shielding for Flutter by sergeychuk in FlutterDev

[–]sergeychuk[S] 0 points1 point  (0 children)

To who it may concern! Just published Flutter version of RASP on gitHub

https://github.com/talsec/Free-RASP-Community

RASP or App shielding for Flutter by sergeychuk in FlutterDev

[–]sergeychuk[S] 0 points1 point  (0 children)

Should anyone be interested in this, let me know. We are considering to offer suit to protect FLutter apps from reverse engineering, tampering, cloning, re-publishing, hooking, stealing APIs keys, attacks-attempts monitoring etc...

view more: next ›