Announcing the DashO v10.2 Release with Resource Encryption for Android

January 23, 2020 1273 Views Matt Insko

The DashO 10.2 release introduces a major new feature: Resource Encryption for Android. It's currently in beta, but is fully supported for production use. It allows you to encrypt the resources embedded in your APK, better protecting your Android application against static attacks.

This functionality integrates directly with your existing Gradle build, encrypting the resources during the standard build process. DashO then injects code into your protected application that will decrypt those resources at runtime.

Resource Encryption is off by default, but can be easily enabled in the DashO UI. The UI makes it easy to enable, or disable, the encryption of specific resources via drag and drop. It currently supports encrypting both assets and raw resources.

Once you install DashO 10.2, using this feature is easy.

Enable on an Existing Project

If you are not currently using Android Mode, introduced in DashO 10.0, please upgrade your project.

First, make sure you are using version 1.1.+ of the DashO Gradle Plugin for Android in your build.gradle file. The previous version does not support Resource Encryption. Next, open your configuration file (e.g. project.dox) in the DashO UI and enable Resource Encryption.

Enable on a New Project

Use the wizard to integrate DashO into your application's build process. This will add version 1.1.+ of the DashO Grade Plugin for Android, which supports Resource Encryption. Next, enable Resource Encryption in the DashO UI.

Building and Testing

This is a beta feature and there are some limitations. It targets select Android resource APIs. Specifically, DashO automatically injects code to decrypt streams produced by the following method calls:

AssetManager.open(String)
AssetManager.open(String, int)
Resources.openRawResource(int)
Resources.openRawResource(int, TypedValue)

Note: If you know certain resources are not read using one of these APIs, you will need to exclude those particular resources from this encryption feature.

Including or Excluding Resources

Once this feature is enabled, DashO by default will encrypt all the assets and raw resources in your application. However, this can be easily configured.

Run a Gradle build then open or refresh the configuration file in the DashO UI. You should see the resources under Resource Encryption -> [Asset|Raw] -> [Include|Exclude].

Depending on how your resources are used, you can either choose to include ones that use the supported APIs or exclude ones that do not. Simply drag the file(s) from the left-hand side to the right-hand side.

Feedback

More information about this feature can be found in the User Guide. We are working on improving this functionality. If you run into any issues or if there are additional Android resource APIs that your application uses, please contact us.

Latest Blog Posts

Protecting Utilities and Infrastructure with PreEmptive's .NET Solution, Dotfuscator

Protecting Industrial Internet Applications

Bayshore Network Case Study

Today’s utilities, factories and other infrastructure are exposed to high risk. The software that controls many of these entities is not protected. In the last 20 years, the way industrial environments operate has completely changed. Many industrial systems were designed with permissive set-ups that assume only the “right people” in the “right place” would ever give instructions. Past systems were not built with exposure to the internet in mind, and as a result they relied on this “air gap” to limit access to only authorized personnel within the organization. The rate of innovation within technology and wireless systems has outpaced the rate of development in security features. Control centers have gotten better - high tech displays and more capability, but this has led to an exposure to untrusted environments… and in many cases this threat has not been addressed.

Application security can often be viewed by development teams as a time-consuming barrier to finishing a project. In a world where "time equals money", the rush to ship functional applications can overshadow the need to ensure those applications are secure. It is true --- features are what sell software and fixing bugs retains customers and loyalty. Both actions can be directly linked to revenue and profitability. So, what effect does an investment in application security have on a company's bottom line?

The coronavirus crisis is changing human behavior. From the persistent need for social distancing to the potentially permanent adoption of work-from-home mandates, the “new normal” is uncharted territory.

But the growing priority of public health also has knock-on effects in other fields, such as credit and debit payments. While the United Stated has historically lagged behind other countries such as Canada, the United Kingdom and Australia when it comes to the adoption of contactless card transactions, the demand for physical distance now trumps the functional familiarity of swipe-and-signature or chip-and-PIN interactions.

Facilitating “no contact normalcy”, the PCI Security Standards Council (PCI SSC) includes guidance for both commercial deployments and software applications to help solve potential payment security gaps. Here’s what you need to know.

Localization is often a key ingredient when building Xamarin Forms applications with a global audience. There are different ways to approach app localization, but most of these leverage the built-in tools provided by the .NET Framework. These include RESX files to configure localized strings and an auto-generated resource class which provides strongly-typed access to the string translation at runtime. This mechanism has been available since .NET 1.1, and is used for localization of WinForm, WPF, ASP.NET, and Xamarin applications.

In the months since we released the Dotfuscator 6 beta, we’ve been hard at work finishing the feature set, fixing issues, and putting on the final touches in preparation for the full release. Now, we are happy to announce the full availability of Dotfuscator 6!

Announcing the DashO v10.2 Release with Resource Encryption for Android

Enable on an Existing Project

Enable on a New Project

Building and Testing

Including or Excluding Resources

Feedback

Protecting Utilities and Infrastructure with PreEmptive's .NET Solution, Dotfuscator

Mobile Application Protection Increases Profits

No Contact Normal: Solving the Payment Security Gap

Protecting Localized Xamarin Forms Applications

Dotfuscator 6: The Next Era of Dotfuscator

Latest Blog Posts

Protecting Utilities and Infrastructure with PreEmptive's .NET Solution, Dotfuscator

Mobile Application Protection Increases Profits

No Contact Normal: Solving the Payment Security Gap

Protecting JavaScript Code: The Making of JSDefender

Protecting Localized Xamarin Forms Applications

Twitter