Automating Xamarin Protection with Dotfuscator

May 10, 2017 4877 Views Joseph Sewell

This week, all eyes of the software community will be fixed on Microsoft's Build conference. Microsoft and its partners are set to announce new technologies and lay out their vision for the future of software development. Recent years have seen the narrative take a decidedly cross-platform approach. Visual Studio Code gives developers tools to create what they want no matter their OS of choice. .NET Core extends the reach of the popular .NET Framework to Mac and Linux. Finally, Xamarin, which was acquired by Microsoft in 2016, lets app developers write their app once, then publish it for Android, iOS, and Windows devices.

As a Visual Studio 2017 Premier Launch Partner, PreEmptive Solutions is pleased to announce, as part of Microsoft Build 2017, a new way to integrate Dotfuscator's protection into Xamarin apps. This new Dotfuscator-Xamarin integration has a number of advantages:

Easy setup - Developers just download an MSBuild targets file and import it into their projects with a few simple property changes. No more need to define custom targets or copy files as a post-build step!
Deep pipeline integration - The new integration automatically puts Dotfuscator into the Xamarin build pipeline, protecting apps as they're built in Visual Studio or MSBuild. Developers don't have to worry about forgetting the protection step, since it's now included as part of the build.
Incremental builds - Don't waste time reapplying Dotfuscator's protection when your project hasn't changed. The integration is smart enough to know when a build is necessary, and when it can be skipped.
Automatic configuration - Get up and running quickly: the integration creates a Dotfuscator config file automatically, with sensible defaults for the project. Instructions are provided for further configuration, including a case study of how to discover which additional identifiers (if any) need to be excluded from renaming obfuscation.
Detailed instructions - We've detailed how to use the integration with a well-known Xamarin.Forms sample. Developers can see the practical application of these instructions through an included git repo, which walks through the process step-by-step.
All major project types supported - The integration supports projects targeting Android, iOS, and Universal Windows (UWP).
Proven protection strategy - The app is protected by Dotfuscator, the industry standard .NET obfuscation and protection tool.
Free to start - The integration works not only with the commercial Dotfuscator Professional Edition, but also with Dotfuscator Community Edition (CE), which is included with Visual Studio. Developers can use the integration to quickly discover the capabilities of Dotfuscator's protection.

To get started, see Integrating Dotfuscator's Protection into Your Xamarin Apps in Visual Studio. There you can read the step-by-step instructions, as well as download the necessary MSBuild targets file.

We plan to keep introducing features like this, to make the protection process easier and more accurate, for Xamarin and all other kinds of apps. Stay up-to-date with the latest Dotfuscator features by visiting the Dotfuscator Downloads page. For announcements and other information, keep an eye on our blog and follow our Twitter account, @PreEmptive.

Artificial Intelligence, Real Threats: Can Attackers Flip the AI Script?

There’s big money in artificial intelligence (AI) — reaching almost $12 billion over the next six years. As noted by research firm McKinsey & Company, companies are now in the process of building out the technology foundation they need for AI deployment, with 45 percent of executives already worried about not investing enough in AI to keep up with the competition. It’s not a baseless fear: The McKinsey research also suggests that AI adoption is following a standard “S-Curve” model, which starts with slow adoption by a limited number of businesses followed by rapid mass adoption as market opportunities increase and then slows again as stragglers are left behind.

Given the wide range of potential applications for AI and the evolution of core intelligence technologies, increased business interest is no surprise. What companies may not be prepared for, however, is the uptick in hacker usage of AI tools and solutions — what happens when attackers flip the AI script?

That was the title of yesterday's congressional briefing organized by ACT | The App Association (in cooperation with the Congressional IP Caucus which is co-chaired by Rep. George Holding, Rep. Adam Smith, & Rep. Hakeem Jeffries).

As is often the case when presenting to different kind of audience (not software-centric), you’re forced to reorganize your thoughts – here are few that might be worth sharing.

Attendees were promised the following agenda:

Learn how rogue apps steal content;
Understand what access devices are enabling the piracy of content;
Learn about a range of app piracy methods used to exploit U.S. companies;
Gain insight into existing industry best practices and enforcement methods for combating IP piracy.

App development now happens at breakneck speeds as companies recognize the need for first-to-market applications that exceed consumer expectations for usability and performance. The root of this rapid release cycle? DevOps — the combination of development and operations teams to deliver best-in-class applications ASAP.

But more apps on the market more quickly means more chances for security issues — as noted by Bank Info Security, 60 percent of all breaches over the last two years started with known software vulnerabilities. Bottom line? DevOps is getting apps out of development, but lack of security is putting them in harm’s way. There are no second chances when it comes to first impressions; users won’t come back if applications expose personal data or become malware distribution drones.

The solution? DevSecOps: Security as a fundamental aspect of application development. Here’s what you need to know.

Model–View–ViewModel (MVVM) is a common pattern used in WPF, Xamarin, and other types of .NET applications. There are different ways to apply the MVVM pattern, but they all share a few underlying concepts. I’d like to discuss these concepts, and how to successfully configure protection with Dotfuscator for MVVM-based apps.

Credentials are a problem for your app. Why? Because they’re a critical access gateway: If attackers get their hands on working usernames and passwords they can cause havoc — everything from stealing user accounts to compromising high-level application functions.

It’s big business; Sensor Tech Forum notes that 85 malicious apps on Google Play were stealing login credentials, while Verizon’s 2018 Data Breach Investigation Report found that 81 percent of hacking incidents used weak or stolen passwords.

And while part of the problem rests with users choosing username and password combinations that are easy to remember and easy for attackers to guess, applications have their own issue: Hard coding. From smart city software to stock trading applications, the use of hard-coded credentials saves time upfront but significantly impacts security.

Don’t become an easy mark for hackers: Here are six ways to boost credential control and reduce total risk.

Automating Xamarin Protection with Dotfuscator

Artificial Intelligence, Real Threats: Can Attackers Flip the AI Script?

Rogue Apps: Facilitating Theft from Developers and Consumers

No Second Chances: App Shielding and the Emerging Need for DevSecOps

Protecting .NET applications that use the MVVM pattern

Create More Secure Applications – Don’t Hard Code Credentials; Instead, Use Application Hardening

Latest Blog Posts

Artificial Intelligence, Real Threats: Can Attackers Flip the AI Script?

Rogue Apps: Facilitating Theft from Developers and Consumers

No Second Chances: App Shielding and the Emerging Need for DevSecOps

Protecting .NET applications that use the MVVM pattern

Create More Secure Applications – Don’t Hard Code Credentials; Instead, Use Application Hardening

Latest News

Dotfuscator Adds Rooted Device Controls to Meet Exceptional Xamarin.Android Demand

Microsoft Build 2018

PreEmptive Solutions Launches GDPR Compliance Relief Program

Protecting Your Xamarin Apps with Dotfuscator

Third Major Dotfuscator Community Edition Release in 12 Months Expands Real-time Defense and Streamlines Xamarin Integration

Twitter

App Protection Blogs

Automating Xamarin Protection with Dotfuscator

Latest Blog Posts

Latest News

Twitter