Rogue Apps: Facilitating Theft from Developers and Consumers

October 10, 2018 99 Views Sebastian Holst

That was the title of yesterday's congressional briefing organized by ACT | The App Association (in cooperation with the Congressional IP Caucus which is co-chaired by Rep. George Holding, Rep. Adam Smith, & Rep. Hakeem Jeffries).

As is often the case when presenting to different kind of audience (not software-centric), you’re forced to reorganize your thoughts – here are few that might be worth sharing.

Attendees were promised the following agenda:

Learn how rogue apps steal content;
Understand what access devices are enabling the piracy of content;
Learn about a range of app piracy methods used to exploit U.S. companies;
Gain insight into existing industry best practices and enforcement methods for combating IP piracy.

The panelists represented a nice cross-section of stakeholders.

Morgan Reed, President, ACT | The App Association (Moderator)
Tom Galvin, Executive Director, Digital Citizens Alliance
Greg Saphier, Senior Vice President, External Affairs, Motion Picture Association of America
Myself (Sebastian Holst, EVP & Chief Strategy Officer, PreEmptive Solutions)

First, I have to thank ACT (again) for their amazing work connecting software developers with their representatives (and vice versa) – and, more selfishly today, for inviting me to participate as a panelist (I always leave ACT events feeling maybe a little guilty hoping that I contributed at least as much as I took away).

Attendance

The bad news is that every representative is away campaigning in their districts – but that was actually the good news – this meant that their staff (who have heavy influence over their boss’ final positions) were free to attend – and we did indeed have a full house – with lots of questions that went beyond the scheduled time slot.

The following summary covers just two of the topics raised and my responses (I don’t want to presume to quote anyone else). I think that the fact that these topics are front of mind on Capital Hill and this audience is extremely important all by itself.

Question 1

As a developer of protection tools for software applications, can you tell us what your clients are experiencing in terms of piracy? (both consumer facing apps and enterprise software attacks)

My response: Consumer facing

There’s the obvious category of primary authors of games, reference, and “convenience” apps – apps whose algorithms or content can be readily repurposed.
We also see App development shops with specialties like (for example) consumer banking. They target smaller banks, savings & loans – these companies have a toolkit that lets them efficiently develop “custom” apps for each bank and their theft is a direct threat to their core business model.
Another category is the technology specialist that delivers niche libraries of – for example – graphics functionality – that other development organizations use. What’s interesting about these is that we see them include IP protection requirements in THEIR licensing terms to their clients, e.g. other development shops. It’s often their clients who need to work with us in order to meet their contractual obligations.

Enterprise facing

An interesting example that is uniquely enterprise is a compliance service provider that migrates massive volumes of archive files and email from any old format that a company might have used over the past 30 or 40 years. The “dictionary” of translation logic to clean up all that data is extremely valuable IP. While no one translation is all that valuable – the sum total in their library of all formats represents hundreds of person years of effort.
Any kind of simulator – automotive, flight, or any kind of “physics” engine
Illegal upgrades to equipment whose functionality is controlled by software – like cars and sophisticated measurement equipment is also an interesting piracy threat – it’s not the software but the equipment that is actually being pirated.

Question 2

So, pirates or hackers are not just ripping off content to redistribute it for a profit. Tell us more about why hackers are attacking your clients’ apps?

My response: We’ve seen a dramatic rise in hackers using apps as a means to get to the data that flows through those apps – examples include

Financial
Healthcare
General PII

As encryption has become more effectively deployed, hackers use developer tools like debuggers to access the data at the only time it isn’t encrypted – when it’s in use – in memory –

They use developer tools to see user data – but also tokens, passwords, and other sensitive data that can be used to elevate user privileges and execute unauthorized code as well.

In fact – from an engineering perspective – there is virtually no distinction between stealing content as a means to compromise systems, e.g. using a trusted brand to deliver a malicious payload versus compromising software or a device to steal valuable content like movies or games from a jailbroken Firestick.

So... the hacking breakthroughs for one criminal pattern (like watching illegal movies) can be equally useful to a multitude of other criminal activities – and – as such – are widely shared and valued by other classes of pirates, cyber-criminals, and nation-state actors.

There were many more questions (and answers) of course - if you’d like to learn more about this briefing and others like it - visit www.actonline.org and introduce yourself – if you have any comments or questions on the topics raised here – (or would like to learn about how PreEmptive Solutions is helping others), please do not hesitate to contact me directly.

Rogue Apps: Facilitating Theft from Developers and Consumers

As is often the case when presenting to different kind of audience (not software-centric), you’re forced to reorganize your thoughts – here are few that might be worth sharing.

Attendees were promised the following agenda:

Learn how rogue apps steal content;
Understand what access devices are enabling the piracy of content;
Learn about a range of app piracy methods used to exploit U.S. companies;
Gain insight into existing industry best practices and enforcement methods for combating IP piracy.

App development now happens at breakneck speeds as companies recognize the need for first-to-market applications that exceed consumer expectations for usability and performance. The root of this rapid release cycle? DevOps — the combination of development and operations teams to deliver best-in-class applications ASAP.

But more apps on the market more quickly means more chances for security issues — as noted by Bank Info Security, 60 percent of all breaches over the last two years started with known software vulnerabilities. Bottom line? DevOps is getting apps out of development, but lack of security is putting them in harm’s way. There are no second chances when it comes to first impressions; users won’t come back if applications expose personal data or become malware distribution drones.

The solution? DevSecOps: Security as a fundamental aspect of application development. Here’s what you need to know.

Model–View–ViewModel (MVVM) is a common pattern used in WPF, Xamarin, and other types of .NET applications. There are different ways to apply the MVVM pattern, but they all share a few underlying concepts. I’d like to discuss these concepts, and how to successfully configure protection with Dotfuscator for MVVM-based apps.

Credentials are a problem for your app. Why? Because they’re a critical access gateway: If attackers get their hands on working usernames and passwords they can cause havoc — everything from stealing user accounts to compromising high-level application functions.

It’s big business; Sensor Tech Forum notes that 85 malicious apps on Google Play were stealing login credentials, while Verizon’s 2018 Data Breach Investigation Report found that 81 percent of hacking incidents used weak or stolen passwords.

And while part of the problem rests with users choosing username and password combinations that are easy to remember and easy for attackers to guess, applications have their own issue: Hard coding. From smart city software to stock trading applications, the use of hard-coded credentials saves time upfront but significantly impacts security.

Don’t become an easy mark for hackers: Here are six ways to boost credential control and reduce total risk.

In 2017 and again in 2018, PreEmptive Solutions surveyed over 15,000 professional developers asking about their organization’s current and projected use of a broad cross-section of development languages and frameworks.

Evaluating each annual survey result on its own and again together as a whole offers insights into current practices, assumptions about future trends as well as the actual trends that played out during the time between the two survey collection points.

The white paper, Multi-Year Developer Survey Reveals Evolving Practices and Foreshadows Further Change shows a professional development community striving to reduce the number of languages and frameworks they rely upon while simultaneously increasing their commitment and investments in the technologies they retain. As this maturation occurs, overall clarity and confidence in their architecture and mission improves.