M8: Code Tampering

Overview

Code tampering is a type of attack where an attacker modifies the code of an application to gain unauthorized access or manipulate its functionality. This can lead to severe technical and business impacts, such as unauthorized new features, identity theft, fraud, revenue loss, and reputational damage.

Description

Code tampering is a common security weakness that can be exploited by attackers to modify the code, resources, or system APIs of an application. This allows them to subvert the intended use of the software for personal or financial gain. Code modification can have wide-ranging impacts, including the introduction of unauthorized features, identity theft, and fraud. Organizations can detect and prevent code tampering by implementing runtime integrity checks and employing security best practices.

How to Prevent ?

To prevent code tampering, mobile apps should include runtime checks to detect code modifications or additions. These checks should react appropriately to code integrity violations. Additionally, organizations can implement techniques such as binary hardening, root detection on Android devices, and jailbreak detection on iOS devices. It is important to consider the business impact of code tampering and tailor prevention strategies accordingly.

Example Attack Scenarios:

• Scenario 1: Game Modification:  In this scenario, an attacker modifies a game app to bypass in-app purchases and steal user identity. The attacker short-circuits conditional jumps that detect successful purchases, allowing users to access premium features without paying. They also insert spyware to steal user identities.

• Scenario 2: Banking App Fraud:  In this scenario, an attacker creates a counterfeit banking app that collects sensitive information, including usernames and passwords, and transmits it to a third-party site. This leads to fraud against the bank and compromises user accounts.

• Scenario 3: Counterfeit App Distribution:  Attackers distribute counterfeit applications containing malware payloads through third-party app stores. These modified apps often mimic legitimate apps and attract users who want to avoid paying for premium features. The malware can result in identity theft and financial loss.