How To Protect Your Secure String Data At All Cost!

First of all, let me be clear about myself; I am not a security expert, just a noob who likes playing around the internet, so if you spot some dumbness or even worse, dont blame me; disclaimer on hahaha.

Okay, enough for something you don't want to hear. Here's the deal! When you make an App, let's say a "Student App," that accesses an API, we will add API_KEY and all the constants that we need for API parameters or API Queries; the point is that you need to secure all the constantStringng that have a connection with your storage source.

Why do i need to protect this thing's if there A Proguard?

The answer is no. Proguard will not Obfuscate your Constant. Here's the link to this statement in case you want to know the Proguard FAQ Link.

So, we must be creative to secure our "Mighty String" from a guy like you.

Why I Wrote This To All Of You Guys?

No, I dont write it for you. It's for me, haha, but if you read this line, you must be interested in this topic.

In my spare time, i always download random ApAppr sometimes just targetting one or two interesting App cause i spot some Widget with an interesting function!. So, when I do this, I usually already know what I am gonna do; here's the list :

1. I use API_KEY to get specific data I need, such as Student Data and Lectures. But the one that I like is "GMAP_API_KEY."
2. Do you use the ApApp and have some interesting features in the ApApp itself? Don't waste your time; see what is inside the ApApp.

Fyi, i have obfuscated the android App A Lot!, not A Lot maybe just a 200 App, usually, i use JADX as my main tools, and CFR 0.140 as Alternative. Why i use both of the tools above?, usually when I try to obfuscate some App from the Big Company, it is tough to read some lines of codCourseCourse, the tool will not De-Obfuscate all da shit), no doubt Big Company have A Bunch and Big Brains IT GuyCourse course hahaha. Back to the toTopic so when i try to de-obfuscate and i fail to read the line that i wanna read, i try to use CFR as the spare gun to see if it i can read the line.

The ratio is 78%. I can read and get what I want; I use the Main And Spare techniques. So what's the point of this ArtArticleso when i read almost all the code that i was obfuscate have the same behaviour when its meStringng!. It was not Obfuscated!, so we can read Loudly that your neighbor will Burn your fukin house with you inside! Hmm, fresh meat for your village I think!.

So what? Here's the point that we use to protect all thiStringng, please write in your head that i am not some security expert with A lot Vertical and Horizontal monitor to run Terminal and Hack the CIA or FBI. With that fact, i can still run SQL injection trhought the API, yah its not your fault FE Guy, its BE correct? But as a team, when your apAppas hack and your customer data get Leaked into a public area i thing that will be a nighmare for all Division!.

So, if we know some really basic SQL injection, we know that we can use the "where" clause to exploit the DB, right? So, when you read API Endpoint, you will know what clause the system needs to execute this task, right?

EX : balabala.com/api/getUserData?id={id}

We will know that Endpoint will run this Query at least "Select * From user_tb Where id = 1"

It will easily be exploited with this SQL Injection payload "anything' OR 'x’=’x" (if there is no SQL Injection prevention system, of course). So, what do I need to run the API correctly? I need to know the specs of the Endpoint, right? Like what kind of HTTP Method it uses, or is there a parameter or path that is the correct key to past data for the Endpoint? And now, we know we can make the Endpoint more secure (at least more difficult to access) if we can scramble the parameter.

What is the idea?

Since the buildSrc folder will not be added to the Application Package, we can use it as a temporary folder for our Raw String. We aim to remove all Raw Strings and inject all obfuscate strings into our class using BuildConfig inside Gradle. This objective absolutely matches the buildSrc behavior of "will not include to App Package."

Let's go to the Moon. Eh sorry, Codelabs I mean!

I will consider you guys as Android Studio ranger from another Galaxy, so i will not cover the basic steps. Before we go any further, please observe the image below :

Real Code

Obfuscated adapter De-Obfuscate

See? Almost all the things exceptStringng are still obfuscated, right? So this is our Homework that we need to burn into the ash!

1, 2, 3 Start!

Let's begin by making the buildSrc folder we need later and then making build.gradle. Kits. You can follow the steps below:

Step 1: make a new directory

Step 2 Give buildSrc as directory name

Step 3: make a new Kotlin script File inside buildSrc

Step 4: give build.gradle as a name

Step 5 Read the explanation below

So, the blue square is where you need to place build.gradle.kts file, and then the orange square is the gradle script we need to run Kotlin inside buildSrc. Last but not least, the pink square is to sync our gradle; press it. Yeah, I know you guys are lazy af (me too, btw, hahaha); you can copy the script below :

[embed]

And then, we gonna make some files inside src/main/java.

File inside directory src/main/java

Then, we will make two .kt files. Give the file names that you like. But in this picture, you will see "Secret.kt and Utill.kt file," so secret.kt is an object class that we will use as the Raw String place, and it is still an extension file to obfuscate the String.

[embed]

[embed]

So, the Secret.kt is where we put any secret string, like Parameter Key for API, API_KEY or even secure shared preference key!. After you implement all the code above, let's make the build field so it will add our constants to the BuildConfig generated file :

[embed]

In this code, we call the Secret Object and use memberProperties to get all variables inside the object as a map. We then get the Variable type, name, and value. After this, you can press the build button, and after it finishes, you can check the BuildConfig File to see if it works or not.

After String Obfuscated

Without String Obfuscation, secreStringng will exposed

How to read the correct value after obfuscation?

After all, as you see above, we still need to define a master key for this obfuscation. So, to make it secure, we can split the key and add each part to a different class or place, and then, finally, we will append where we need to access it.

[embed]

After string obfuscation

Yeah, finally, we were done to implement string obfuscation. I know this is far from "secure", but the point of this artArticle "please consider to make your repo, implement same objective with different concept or whatever, so noob guy like me can learn more from you guys". Best regard — Mamang Somay!

*CMIIW, and noob disclaimer Always On!