Partners with PreEmptive Solutions for limited-time free coding tool
Microsoft is promoting the idea of code “obfuscation” as a way to make Windows Phone 7 apps more secure, and it’s doing so via a partnership with PreEmptive Solutions. The vendor now offers a special Windows Phone version of its code obfuscation tool along with a set of cloud-based service that collects, manages, and reports analytical data captured from the downloaded WP7 apps.
There’s a new “Network World” story on this, sparked by a recent incident that stirred debate over how secure WP7 (or Android or other mobile apps) are, can be, or should be expected to be.
The heart of a WP7 app is a version of Microsoft’s .Net code framework. The application code runs in a virtual machine, which interprets it and makes calls to the underlying operating system. For WP7, the virtual machine is provided by either Microsoft Silverlight or Microsoft XNA Studio on the handset itself. From the outset, .Net applications, like those of other managed code environments such as Java (and by extension Android, among other mobile operating systems) have been easy to disassemble for experienced programmers.
As the story notes, there is some controversy over how effective obfuscation actually is. The word means “Render obscure, unclear, or unintelligible.” In effect, you can think of it as a sophisticated version of “pig Latin” — a language game of alterations, which is intelligible to the intended recipient but obscure to someone overhearing the exchange. Experienced developers with whom I talked generally seem to regard obfuscation as one tool that can be and, depending on what’s in your app, should be used to protect your code. Other practices include encrypting the on-device app code, in whole or in part; and keeping critical information or intellectual property on a secure server, accessed via the cloud.
Obfuscating code uses a set of transforms on the application code, such as renaming methods or properties, or using unprintable characters, and renaming not just an executable but also other components, including XML resources, according to PreEmptive Chief Marketing Officer Sebastian Holst, in an email exchange. This type of transforms makes it harder for a human to read the code. Another set of transforms trips up machine translations of code, by manipulating control flows to create alternate instruction stacks. The alternatives, says Holst, are “logically equivalent to the original program but a) do not translate into valid programming language syntax and b) do not reflect [the] common patterns that compilers use and [that] reverse engineering utilities rely upon to reverse engineer binaries.”
Combined, “there is ample evidence that obfuscation effectively and consistently deter the curious and opportunistic, materially impede the malicious, and if necessary [provides a basis to] prosecute the successful – no different than what we expect from a lock on a door or a safe in a bank,” Holst says.
The new joint offering with Microsoft is quite different from the vendor’s previous two version of its Dotfuscator product, which both protects an app and “instruments” it so that a bunch of data can be collected about its performance. The free and basic Community Edition, embedded in Microsoft Visual Studio, was released in April 2010. According to Holst, this version “can, with a significant amount of manual intervention, provide a modest level of protection and analytics for Windows Phone 7.” (Microsoft just announced that Visual Studio now supports WP7 development.) The second version is the full commercial, or professional, product licensed from the vendor, with “significantly enhanced functionality for protection, analytics and Visual Studio/build integration,” according to PreEmptive. Pricing starts at $2,500.
Finally, PreEmptive’s Runtime Intelligence Service, for collecting and managing runtime data on an app, has been available as a managed service priced at about $300 per month.
By contrast, the new WP7 offering combines the commercial version of Dotfuscator with the Runtime Intelligence Service in a vastly more affordable package, which is essential for developers who may be selling an app for just $1.99. PreEmptive has created a new, single SKU to order the combined offering, which is available free only to WP7 developers through March 31, 2011.
After that date, it will be priced as a monthly subscription service. That price hasn’t yet been finalized but Holst says “We are aiming for an under-$10 option but this is not yet set in stone.” He adds, “…under no circumstances will developers be forced to move to the professional [version].”
Dotfuscator isn’t the only such tool. Another is Crypto Obfuscator, from LogicNP Software.
If you’re a WP7 coder, are you using obfuscation? Why or why not? If yes, what tool are you using to do it? If not, what other steps, if any are you taking to protect those parts of your application that need protecting? Are there other steps Microsoft should be taking, and if so, what?
