This document summarizes a study on software obfuscation in mobile apps. It found that (1) most obfuscated apps incorporate obfuscated third-party libraries, (2) common obfuscation techniques include symbol renaming and string encryption, and (3) preliminary tests found obfuscation was not fully effective at preventing reverse engineering for one-third of apps analyzed. The study provides insights into real-world mobile app obfuscation practices and their effectiveness.

1. Software Obfuscation on the Go:
A Large-Scale Empirical Study on
Mobile App Obfuscation
Pei Wang, Qinkun Bao, Li Wang, Shuai Wang, Zhaofeng Chen†,
Tao Wei†, and Dinghao Wu
The Pennsylvania State University
†Baidu X-Lab

2. Market of Mobile Apps Grows Fast
~29% annual growth 2013–2017

3. Yet Mobile Developers are Troubled
● Piracy
○ Piracy rates of popular apps can approach to 95%
● Exploitable vulnerabiltities
○ OAuth2 bugs affecting apps with millions of users
● Repackaging
○ Benign-looking malware
● Fraudulent campaigns
○ A million-dollar underground economy

4. Software Obfuscation Comes to the Rescue
Obfuscation: Program transformations that make
software difficult to understand and analyze
● Raise the bar of reverse engineering
● Buy time for more permanent security solutions

5. Many Obfuscation Techniques Proposed

6. The Problem
● Most obfuscation research focuses on the desktop
environment
● Much less is known about obfuscation for mobile

7. A Large-Scale Empirical Study on Obfuscated
Mobile Apps
● Investigate software obfuscation in real-world mobile
app development
○ (RQ1) Characteristics of obfuscated apps
○ (RQ2) Popular obfuscation patterns
○ (RQ3) Possible impacts from app reviews
○ (RQ4) Effectiveness of obfuscation
● Focus on iOS
○ Important platform deserving more attention from academia

8. Methodology
1. Problem Scoping
2. Sample Collection
3. Sample Inspection

9. Step #1 — Problem Scoping
● Too many obfuscation algorithms, cannot afford to
consider them all
● Which ones are most widely applied?

10. Ask Google
● Search for commercial and open-source obfuscation tools
● Pick the top 4 most popular obfuscation methods for iOS
apps
○ Symbol renaming
○ String literal encryption
○ Decompilation disruption
○ Control flow flattening

11. Step #2 — Sample Collection
● Start with the entire App Store
○ 1,145,582 app instances crawled from Feb. to Oct. 2016
○ Include different versions of the same app
● Identify apps obfuscated
○ Technically difficult to automatically detect all 4 obfuscations in
a million apps

12. Assumption
Developers who picked heavyweight methods would very
likely also pick lightweight methods
● Set symbol renaming as the baseline
● Detect apps obfuscated with symbol renaming first
● Manually identify other obfuscations in the narrowed set
of candidates

13. Detecting Scrambled Symbol Names
Insight: Human-written source code is “natural” in the sense
that it can be described by statistical language models like n-
gram
(Abram Hindle, Earl T. Barr, Zhendong Su, Mark Gabel, and Premkumar Devanbu.
On the Naturalness of Software. ICSE '12.)

14. Detecting Scrambled Symbol Names
● Segment symbol names into a sequence of words
● Measure how "surprising" the sequence is within an n-
gram language model
○ "Unnatural" names are considered to be obfuscated
● Use cross-entropy for measurement

15. Sample Collection Summary
● Rank apps by likelihood of obfuscation
● Manually verify top 6,600 samples
● Identified 601 true positives, grouped into 539 apps

16. Step #3 — Sample Inspection
● Manually confirm if the sampled apps are protected by
the other 3 methods
○ Over 600 man-hours to analyze 601 app instances
● Pay special attention to obfuscated third-party libraries
○ Apps may passively get obfuscated for linking against
obfuscated libraries

17. Results
(RQ1) Characteristics of obfuscated apps
(RQ2) Popular obfuscation patterns
(RQ3) Possible impacts from app reviews
(RQ4) Effectiveness of obfuscation

18. Results
(RQ1) Characteristics of obfuscated apps
(RQ2) Popular obfuscation patterns
(RQ3) Possible impacts from app reviews
(RQ4) Effectiveness of obfuscation

19. Impact of Third-Party Libraries
● 75.1% of analyzed apps contain
obfuscated third-party libraries
● Only 24.9% of the studied apps are
actively obfuscated by developers
● The other 63.8% are passively obfuscated
due to the inclusion of obfuscated
libraries
● Advertising libraries are most popular —
included by 48.1% studied apps
● Payment and banking libraries are the
second most popular — included by 18.7%
apps

20. App Distribution by Categories
● Apps related to finance,
medical, copyrighted digital
content, and personal activities
are more likely to be obfuscated
● Games are more likely to be
passively obfuscated
● There is a similar distribution
for obfuscated libraries of each
category

21. Results
(RQ1) Characteristics of obfuscated apps
(RQ2) Popular obfuscation patterns
(RQ3) Possible impacts from app reviews
(RQ4) Effectiveness of obfuscation

22. Obfuscation Patterns

23. Obfuscation Patterns
Finding 1: The majority of apps apply obfuscation at
module-level, suggesting a wide adoption of automated
tools

24. Obfuscation Patterns
Finding 2: More costly obfuscation algorithms are less popular

25. Obfuscation Patterns
Finding 3: Apps of certain categories tend to be more heavily obfuscated than the others

26. Finding 4: 27 of the 195 actively obfuscated apps were
unobfuscated at the beginning of the crawling period,
indicating more and more mobile developers have become
interested in software protection
Obfuscation Patterns

27. Results
(RQ1) Characteristics of obfuscated apps
(RQ2) Popular obfuscation patterns
(RQ3) Possible impacts from app reviews
(RQ4) Effectiveness of obfuscation

28. Case Studies
Found two cases that suggest app review can either
stimulate or restrain the adoption of obfuscation

29. Case #1
● A third-party library trying to use private API and
circumvent app review by obfuscation
● Busted by Apple in 2015, all including apps reported to be
removed
○ Library developers found new obfuscation methods to evade
detection

30. Case #2
● A reputed security service provider submitted a simple
poker game app that is extremely heavily obfuscated
● Obfuscator developers may want to test what
obfuscation algorithms are acceptable to Apple

31. Results
(RQ1) Characteristics of obfuscated apps
(RQ2) Popular obfuscation patterns
(RQ3) Possible impacts from app reviews
(RQ4) Effectiveness of obfuscation

32. Preliminary Penetration Tests
● Test the resilience of the obfuscated samples by simple
reverse engineering
○ Dump symbol names and string literals
○ Manually identify interesting keywords like "secret" and "private
key"
● 33 of 195 actively obfuscated apps still leak certain
sensitive information
○ Obfuscations failed to be as effective as they could have been

33. Conclusion
● First large-scale empirical study mobile obfuscation
● Filled in the blank of academic iOS app store studies
● Better understanding on how obfuscation is used in real-
world mobile development
● The practice of obfuscating mobile apps require
improvement