Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let us assume that I have the following code:

namespace MobileApp
{
    public class Storage
    {
        public Storage()
        {

        }

        public bool Save()
        {
            bool success = false;

            try
            {
                var settings = IsolatedStorageSettings.ApplicationSettings;

                if (settings.Contains("AppInformation7563"))
                {
                    settings["AppInformation7563"] = "GG3MDhlxnZDdDx7";
                }
                else
                {
                    settings.Add("AppInformation7563", "GG3MDhlxnZDdDx7");
                }

                settings.Save();
                success = true;
            }
            catch (Exception)
            {
                success = false;
            }
            return success;
        }

        public string Load()
        {
            string app = "false";

            try
            {
                var settings = IsolatedStorageSettings.ApplicationSettings;

                if (settings.Contains("AppInformation7563"))
                {
                    app = settings["AppInformation7563"].ToString();
                }
            }
            catch (Exception)
            {
                app = "false";
            }
            return app;
        }
    }
}

Basically, this code stores a secret password in Windows Phone isolated storage so that this password is passed whenever a web service call is made.

If I obfuscate the code using DotFuscator, will the "AppInformation7653" and "GG3MDhlxnZDdDx7" be obfuscated as well? Or will they remain the same, just the names of the classes and variables are changed?

Thank you very much :)

share|improve this question
    
Why would an attacker care? They can simply read the value from isolated storage. –  CodesInChaos Jul 18 '13 at 13:16
    
How can they read it from isolated storage? As far as I know, only the application can access that part of memory. Am I right? –  Matthew Jul 18 '13 at 13:24
1  
My assumption is that the attacker can root the phone after which they can access whatever they want. –  CodesInChaos Jul 18 '13 at 13:46
    
Hmm... So how can I store the key securely please? Thank you. –  Matthew Jul 18 '13 at 13:48
    
First of all, how can the attacker root the phone? Does he require physical access to the phone? –  Matthew Jul 18 '13 at 13:49
show 3 more comments

2 Answers

up vote 4 down vote accepted

DotFuscator will "encrypt" string literals, although I cringe at the use of the word "encryption" in that context. Your string values "AppInformation7653" and "GG3MDhlxnZDdDx7" won't appear "as is" in the resulting assembly, but the code necessarily contains everything that is needed to rebuild their respective values at runtime. So don't believe that such obfuscation will actually thwart reverse engineering; it may just deter the least motivated or competent of attackers, but skilled attackers will just laugh at your feeble attempts at obfuscation.

As usual, code obfuscation is more about giving a feeling of security than actually making things more secure. The real value of obfuscation is that it demonstrate your intent of keeping the code internals somewhat secret, which can be handy in some legal situations (a reverse-engineer will not be able to claim that he "didn't know", in good faith, that the code was not supposed to be scrutinized that way). As will all things legal, this may or may not work in any specific jurisdiction, and I am not competent to give any specific legal advice anyway.

share|improve this answer
    
Thank you so much for your answer :) I appreciate the time you took in order to answer my question in this high level of detail :) Thank you so much :) And sorry for responding 5 days late :s –  Matthew Jul 23 '13 at 16:43
add comment

Your public class and method names won't change, because they're externally referenceable, they can't. Since public types may be used by other libraries and applications that the obfuscator has no knowledge off, they must be preserved.

As to the string values, they may or may not be obfuscated. They usually are, but I haven't used DotFuscator, so I don't know specifically how it works. You should create an obfuscated build and then inspect it using a tool like Reflector or ILSpy to determine exactly what it's been able to do to your assembly.

share|improve this answer
    
Thank you so much for the answer Xander :) I appreciate it immensely :) And sorry for responding 5 days late :s –  Matthew Jul 23 '13 at 16:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.