Contact Us Blog Register Login
PreEmptive -
  • Home
  • Products
    • Application Protection
      • Dotfuscator for .NET
        • Overview
        • Features
        • Compare Editions
        • Xamarin Protection
        • Videos & Resources
        • Pricing
        • Downloads
      • DashO for Android & Java
        • Overview
        • Features
        • Videos & Resources
        • Pricing
        • Downloads
      • JSDefender for JavaScript
        • Overview
        • Features
        • Online Demo
        • Pricing
        • Downloads
      • PreEmptive Protection for iOS
        • Overview
  • Support
    • Product Support
      • Dotfuscator for .NET
      • DashO for Android & Java
      • JSDefender for JavaScript
      • PreEmptive Protection for iOS
    • Resources
      • White Papers
      • Glossary
      • Videos
  • Solutions
    • App Protection Solutions
      • Mobile App Protection
      • Desktop & Server App Protection
      • General Data Protection Regulation (GDPR)
      • Security Development Lifecycle
      • Application Integrity Protection
      • Mobile RASP
      • PCI Mobile Payment Acceptance Security
  • Company
    • About
      • Why PreEmptive?
      • About Us
      • Careers
      • Blog
    • Contact
    • Legal

Rogue Apps: Facilitating Theft from Developers and Consumers

October 10, 2018 3059 Views Sebastian Holst
Congressional briefing

That was the title of yesterday's congressional briefing organized by ACT | The App Association (in cooperation with the Congressional IP Caucus which is co-chaired by Rep. George Holding, Rep. Adam Smith, & Rep. Hakeem Jeffries).

As is often the case when presenting to different kind of audience (not software-centric), you’re forced to reorganize your thoughts – here are few that might be worth sharing.

Attendees were promised the following agenda:

  • Learn how rogue apps steal content;
  • Understand what access devices are enabling the piracy of content;
  • Learn about a range of app piracy methods used to exploit U.S. companies;
  • Gain insight into existing industry best practices and enforcement methods for combating IP piracy.

The panelists represented a nice cross-section of stakeholders.

  • Morgan Reed, President, ACT | The App Association (Moderator)
  • Tom Galvin, Executive Director, Digital Citizens Alliance
  • Greg Saphier, Senior Vice President, External Affairs, Motion Picture Association of America
  • Myself (Sebastian Holst, EVP & Chief Strategy Officer, PreEmptive Solutions)

First, I have to thank ACT (again) for their amazing work connecting software developers with their representatives (and vice versa) – and, more selfishly today, for inviting me to participate as a panelist (I always leave ACT events feeling maybe a little guilty hoping that I contributed at least as much as I took away).

Attendance

The bad news is that every representative is away campaigning in their districts – but that was actually the good news – this meant that their staff (who have heavy influence over their boss’ final positions) were free to attend – and we did indeed have a full house – with lots of questions that went beyond the scheduled time slot.

The following summary covers just two of the topics raised and my responses (I don’t want to presume to quote anyone else). I think that the fact that these topics are front of mind on Capital Hill and this audience is extremely important all by itself.

Question 1

As a developer of protection tools for software applications, can you tell us what your clients are experiencing in terms of piracy? (both consumer facing apps and enterprise software attacks)

My response: Consumer facing

  • There’s the obvious category of primary authors of games, reference, and “convenience” apps – apps whose algorithms or content can be readily repurposed.
  • We also see App development shops with specialties like (for example) consumer banking. They target smaller banks, savings & loans – these companies have a toolkit that lets them efficiently develop “custom” apps for each bank and their theft is a direct threat to their core business model.
  • Another category is the technology specialist that delivers niche libraries of – for example – graphics functionality – that other development organizations use. What’s interesting about these is that we see them include IP protection requirements in THEIR licensing terms to their clients, e.g. other development shops. It’s often their clients who need to work with us in order to meet their contractual obligations.

Enterprise facing

  • An interesting example that is uniquely enterprise is a compliance service provider that migrates massive volumes of archive files and email from any old format that a company might have used over the past 30 or 40 years. The “dictionary” of translation logic to clean up all that data is extremely valuable IP. While no one translation is all that valuable – the sum total in their library of all formats represents hundreds of person years of effort.
  • Any kind of simulator – automotive, flight, or any kind of “physics” engine
  • Illegal upgrades to equipment whose functionality is controlled by software – like cars and sophisticated measurement equipment is also an interesting piracy threat – it’s not the software but the equipment that is actually being pirated.

Question 2

So, pirates or hackers are not just ripping off content to redistribute it for a profit. Tell us more about why hackers are attacking your clients’ apps?

My response: We’ve seen a dramatic rise in hackers using apps as a means to get to the data that flows through those apps – examples include

  • Financial
  • Healthcare
  • General PII

As encryption has become more effectively deployed, hackers use developer tools like debuggers to access the data at the only time it isn’t encrypted – when it’s in use – in memory –

They use developer tools to see user data – but also tokens, passwords, and other sensitive data that can be used to elevate user privileges and execute unauthorized code as well.

In fact – from an engineering perspective – there is virtually no distinction between stealing content as a means to compromise systems, e.g. using a trusted brand to deliver a malicious payload versus compromising software or a device to steal valuable content like movies or games from a jailbroken Firestick.

So... the hacking breakthroughs for one criminal pattern (like watching illegal movies) can be equally useful to a multitude of other criminal activities – and – as such – are widely shared and valued by other classes of pirates, cyber-criminals, and nation-state actors.

There were many more questions (and answers) of course - if you’d like to learn more about this briefing and others like it - visit www.actonline.org and introduce yourself – if you have any comments or questions on the topics raised here – (or would like to learn about how PreEmptive Solutions is helping others), please do not hesitate to contact me directly.


Start a Free Trial

Tweet
Share

Categories

  • Dotfuscator

  • Dotfuscator CE

  • DashO

  • JSDefender

  • Press Releases

  • Mobile Protection

  • Risk Management

  • Support Corner

Latest Blog Posts

Protecting Java applications that use Jackson for JSON



JSON is a standard format for sharing objects and data within an application. When working in Java, there is no built-in support for JSON processing. There are, however, several widely-used libraries and options to choose from. In this article, we will focus on Jackson, which is one of the most popular.

Read more

Protecting C# applications that use AutoMapper



AutoMapper is an object-to-object mapping system used by many of our customers. It aims to simplify and organize code responsible for sharing instance values from an object of one type to an object of a different type.

Read more

Inventa, Wireless Technology Company, Protects their Android Application with DashO



Inventa, a Wireless Technology Company, Protects their Android Application with DashO

The Beginnings of Inventa

Having worked in the wireless mobile technology domain in the US, Anand Virani, became intrigued by the growing tech and wireless trends and wanted to explore the field more for himself. He noticed a boom in the Internet of Things (IoT) and that smartphones were becoming more central to how people interacted with each other at home, in the office, and in public places. What if there was a way phones could connect with each other without the need for Internet or cloud access? Smartphones were the future and Virani was determined to make a profitable business model based on this new trend.

Read more

Surgical Theater Protects their Medical Applications with Dotfuscator



Surgical Theater Protects their Medical Applications with Dotfuscator

How It All Started

How is flying a fighter plane similar to performing neurosurgery? They have more in common than you’d think. In 2005, Monty Avisar and Alon Geri, two Israeli fighter pilots were assigned to work with Lockheed Martin to build a $50 million F-16 Flight Simulator program for the Israeli Air Force to improve hand-eye coordination skills for their pilots during combat. Avisar took on the role of project manager and Geri served as senior engineer; the project was a success.

Four years later in 2009, the two finished their military service in Israel and moved to Cleveland, Ohio. Their experience working in virtual reality applications inspired them to wonder where this technology could also be applied. With several connections to surgeons, the two came to understand the ins and outs of operation procedures; in a similar way, surgeons were also working on a battlefield. What if surgeons could also train like fighter pilots and preview their surgical procedure, much like a fighter pilot could pre-fly their mission? The surgeons could pre-plan the operation from every angle and every approach to increase their situational awareness. And a year later, Surgical Theater was born.

Read more

Integrating DashO into a Maven Build



Maven is perhaps the most widely-used project management tool for Java. Based on the Project Object Model (POM), it is used not only for compilation of source code, but also dependency management, documentation, running tests, packaging, deployment, and more. We are frequently asked if we have a Maven plugin for running DashO. Though we do not offer a specific Maven plugin, adding DashO to your Maven-based project is surprisingly easy by leveraging Ant.

Read more

preemptive logo

767 Beta Dr. Suite A
Mayfield Village, OH 44143

Tel: +1 440.443.7200

solutions@preemptive.com

Latest Blog Posts

Protecting Java applications that use Jackson for JSON

December 30, 2020
Read more

Protecting C# applications that use AutoMapper

November 18, 2020
Read more

Inventa, Wireless Technology Company, Protects their Android Application with DashO

November 10, 2020
Read more

Surgical Theater Protects their Medical Applications with Dotfuscator

October 30, 2020
Read more

GlobalMed Finds Success by Switching to JSDefender

October 21, 2020
Read more

Twitter

@baldbeardbuild @GirlsWhoCode @baldbeardbuild thanks so much for inspiring us to be BUILDERS in our own community!… https://t.co/U6AyqPDhsa Jan 14 • reply • retweet • favorite

Copyright © 2020 PreEmptive

  • Home
  • Contact Support
  • Blog
  • Contact
Scroll to Top

PreEmptive uses cookies to improve the functionality of our website. By using this site, you agree to the use of cookies.