Wednesday, December 19, 2012

Obfuscating to a small self contained library .jar

In the case you would like to create a library jar file, you could:

  • Run Proguard once on the library .jar file - this can make the library self-contained and prevent package name collisions.
  • Run Proguard once on the application that uses the library file.


Step by step:

  1. Ofuscation of library jar is based on http://proguard.sourceforge.net/index.html#manual/examples.html - A typical library.
  2. To make the library .jar small, list classes to be kept explicitely instead of -keep public class * {public protected *;}
    • -keep public class my.package1.* {*;}
    • -keep public class my.package2.* {*;}
  3. To make the library smaller, remove unused classes and obfuscate the used ones, omit -dontshrink
  4. To optimize and remove dead code, omit -dontoptimize
  5. In the case of "Unknown verification type [32] in stack map frame" problems when obfuscating the app, try disabling optimizing rules of the library according to http://proguard.sourceforge.net/index.html#manual/optimizations.html. Examples that can be tried until no more errors:
    1. -optimizations !class/merging/*, !field/*, !method/*, !code/*
    2. -optimizations  !code/*, !field/*
    3. -optimizations !field/*
    4. -optimizations !field/propagation/value
  6. Finally, repackage classes to your organizations domain (www.package.my):
    1. -allowaccessmodification
    2. -repackageclasses 'my.package'
You should now have a library .jar where all or most classes are obfuscated located under my.package.*.class


Wednesday, November 14, 2012

Encap won the award in the Funded category for Norwegian Startups in the Nordic Startup Awards 2012-11-13 at MESH. Thank you for the votes, and thanks to our sustaining investor Alliance Venture. The award includes mentoring and partly TINC funding. The Nordic finale is in Copenhagen 7 Dec 2012.

Ensafer was also among the finalists in the Bootstrapper category - it belongs to the story that Encap and Ensafer apply for a research project together. Ensafer launches Dropbox encryption.

Encap has passed several phases during development. Initially, we put effort in making the product covering ca. 80% of the mobile devices in the consumer market, university and third party evaluations, and approval for the norwegian banking standards. Recently, effort has been made to make the product easy available for developers and integrators, this will be available at http://developer.encapsecurity.com within Dec 2012.

Tuesday, April 10, 2012

Update of Samsung Nexus S from 2.3.6 to Android 4.0 OTA A pop-up dialog is shown approximately after update is downloaded and ready for install. Pushing the the button for “More Information” reveals it’s an OTA update to Android 4.0.4. Pushing the button for restart and install starts the update that will last a few minutes before Android 4 is waking up:

Saturday, March 10, 2012

List of SSL/TLS root certificates

Before purchasing an SSL/TLS certificate for a web server, it is interesting to know whether the mobile device accepts the certificate.

Procedure

1. Download http://bouncycastle.org/download/bcprov-jdk16-141.jar and place it on $JAVA_HOME/jre/lib/ext/

2. get the certificates file

adb pull /system/etc/security/cacerts.bks cacerts.bks 

3. List certificates with keytool.

keytool -list -v -storetype BKS \
      -provider org.bouncycastle.jce.provider.BouncyCastleProvider \
      -keystore ~/Downloads/cacerts.bks.SE_X10 \
       | grep ^Issuer | sort | cut -b 9-

Enter keystore password:

When prompted for password, push enter and ignore the warning. The result will be a list of TLS/SSL certificates that can be inspected. Example findings:

  • Sony Ericsson X10 mini pro: RapidSSL not present.

Monday, February 6, 2012

Wednesday, February 1, 2012

Mobile platform security links

The following links contain information relevant for mobile platform security.

Custom URL

Starting an app by opening a custom URL will fail if the app is not installed. Exampes.

Operating system, update and security

Android, generic update overview:

Android security:

iiOS OTA update:

iOS Security:

Keychain / crypto

iOS keyChain

Android keychain:

iOS Data protection

Crypto libraries

Android

iOS

Application Stores

Overview

Threats / malware

Android

Windows Phone Marketplace

Nokia store

Firewall and anti trojan / anti virus

Firewall
  • Wikipedia: "permit or deny network transmissions based upon a set of rules"

Firewall programs from the application stores App Store / Market:

  • Android: Droidwall (requires root)
  • iOS: None (Lookout: Warn if on unencrypted WiFi)
Anti trojan / anti virus

Protection from malicious apps - anti-virus, block outgoing calls and SMS, and similar.

Android Market:

Developing