Has anyone tried or used mobile security solutions...

# android

[Vyshas]

Has anyone tried or used mobile security solutions for your apps ? I have shortlisted two of them that spiked my interest and they are guardsquare (guardsquare.com) and zimperium(zimperium.com). It would be helpful if someone could let me know if you had experience with these products as I'd like to improve my app security

[Umar Ata]

What type and level of security you need

[Umar Ata]

You can simply use some algorithms like bouncy castle or spongy castle or aes to encrypt your data

[Vyshas]

code hardening, Runtime application self protection from live attacks, real time threat monitoring

[Umar Ata]

App is just a frontend
You may focus on securing the rest APIs

[Vyshas]

that is a small piece in the security puzzle especially when it comes to financial apps

[Vyshas]

SSL pinning, encrypting data can also be manipulated for rooted devices…..that is why the products from above solutions are widely used….

[Umar Ata]

If the device is rooted then you can make a check that most of the apps do and do not run app on rooted device

[Vyshas]

No we are looking into both solutions for our financial apps and looking at experience from others..

[Umar Ata]

If you check popular banking apps like sbi, icici they are simply working on webview
Not all of their features are native

[Vyshas]

I think we are digressing from my question…..we have different requirements and we are well established in UK….

[Umar Ata]

The main problem in using any third party security solutions is that to allow them to access all the data

[Umar Ata]

I am just trying to make you aware of pros and cons

[Vyshas]

thanks

[Joost Klitsie]

@Umar Ata usually you wouldn't use webapps if you want things secure, embedding web apps is a way to cut corners and costs. "It's just frontend" is not really a valid argument here. Security comes from many layers, securing the frontend is one of those.
Using proper third party security solutions will NOT allow 3rd parties to access all data. How do you imagine this? They usually provide libraries that run offline and will not have access to the final product or its data, as the tools do not include communication and such things (except if they put in a backdoor but you should not assume that 🙂 ).

• Do not store sensitive data if not needed
• Store key material in hardware key stores
• Do not ever think there is a library that can protect you from rooted phones, it is a cat and mouse game.
• Obscure the code
• Encrypt valuable strings and resources
• Use cert pinning and 2-way ssl
• Remove logging
I have experience with Dexguard on a payment application (from guardsquare) and I had an introduction with Arxan protecting native code, now known as Digital Ai, I think nowadays they also provide protection for Java code (if I can believe the marketing emails they are still sending 😄 )

From Dexguard I can say it did all the things we wanted, it provided some root protection, it obscured/hardened the code pretty good, you can encrypt credentials (like the certificates you use for pinning) and I think the best part it is configurable a lot like proguard (same vendor 🙂 )

[Umar Ata]

Suppose you install antivirus software in your computer and now you scan your drive and for scan it needs read access obviously then how can you think that it can't read your data? @Joost Klitsie

[Joost Klitsie]

@Umar Ata then you should really check out these security libraries before you make assumptions

[Joost Klitsie]

dexguard for example is a commandline tool, it runs when building an application

[Joost Klitsie]

it does not create a network connection when you start up the app

[Joost Klitsie]

most of the things it does is only during build time

[Umar Ata]

I am not making any assumptions here
I have experience in both native and third party security solutions
I can only be sure for them to not read my data when they provide their source code

[Joost Klitsie]

things like root detection is invcluded as a library

[Joost Klitsie]

well that is a matter of trust

[Joost Klitsie]

but to compare to antivirus is a very bad comparison

[Joost Klitsie]

antivirus updates itself

[Joost Klitsie]

it scans a running system

[Joost Klitsie]

sometimes it sends out files to scan serverside

[Joost Klitsie]

depending on which one

[Joost Klitsie]

if you just assume guardsquare doesn't want to lose all their customers by adding some undocumented backdoor, your data is MORE secure with dexguard than without it

[Umar Ata]

I think you are from same team and marketing your product here

[Umar Ata]

Anyways it is totally not related to kotlin

[Vyshas]

Thanks Joost, I have shortlisted digital.ai as well….my priority at the moment is guardsquare ever since they acquired Appray…..

[Umar Ata]

And not good for the channel purpose

[Vyshas]

@Joost Klitsie, does Dexguard capture screenshot capture detection and do you know how IxGuard works in iOS …surely the channel is for android but out of Curioisity?

[Joost Klitsie]

So why did you answer in the first place if it is so off-topic? Your comment was my main motivation to answer this question. And no I do not work for guardsquare, if you read my comment then you can see that I used it on a project and I shared my experience. I cannot tell other experiences because they are limited, but arxan looked interesting

[Joost Klitsie]

@Vyshas I have no experience on iOS sadly, so I cannot tell you

[Vyshas]

cool….does DexGuard support root detection ?

[Joost Klitsie]

yes

[Joost Klitsie]

you can see their features here: https://www.guardsquare.com/en/products/dexguard

[Vyshas]

thanks