2

As I understand, code obfuscation is used to make reverse engineering difficult/hard for the adversaries/red team.

Now if I use a source code obfuscator where a .C/.CPP file is used as input and an obfuscated .C/.CPP file is generated, should the source code repository such as GIT/SVN store the plain text.C/.CPP file or obfuscated .C/.CPP file?

Next, if a plain text .C/.CPP file is stored in the repository, any attacker gaining access to the repository system would immediately gain access to IP-protected code or if the code was published in public github by mistake. Is that right?

In the other case, where the obfuscated .C/.CPP files are stored in the version repository system, the development team would face issues such as readability and unmanageable code. Is that correct?

So, what is the best means to protect & store the source code?

Improve this question
4
  • The obfuscatory I know usually work on binary level or on an intermediate representation at compile time. Obfuscation at source code level is usually something people only do if the try to manually obfuscate their code.
    – Robert
    Commented Oct 27, 2022 at 21:46
  • 4
    I think anyone who's trying to protect their code would not be using Github. You'd setup your own repo on your own secured server. We used to use one called "Subversion".
    – browsermator
    Commented Oct 27, 2022 at 22:07
  • @Robert Well, you do that for interpreted languages where there is no binary format. It's super common in Javascript, in addition to "minification" (which by itself is a form of obscuration, since variable/function names helps a lot understanding code)
    – GACy20
    Commented Nov 29, 2022 at 9:53
  • I think automatic code obfuscation has nothing to do with security or intellectual property (IP). If you store only the obfuscated code in your source repository, then have fun when hunting for bugs or changing it (MHO)! The best way to protect and store source code is on a trusted local platform that has reliable backups. And you can digitally sign you code.
    – U. Windl
    Commented Feb 15, 2023 at 23:40

4 Answers 4

Reset to default
0

So what is the best means to protect & store the source code?

The "best" is usually a trade-off between how good risks can be addressed without impacting other requirements like usability. And then one would need to find ways on how to mitigate the remaining risks.

In your case this could mean

  • Keep the clean source code in the repository (usability requirement) but protect the code repository against unauthorized access (risk mitigation). How this can be done depends on your specific environment and infrastructure.
  • Make your implementation not depend on obfuscation for security, i.e. it should be only an additional security layer. How this can be done depends on your specific use case, code base, security requirements, testing and quality assurance capabilities ... This way there is not much harm if the attacker finds out your source code.
Improve this answer
0

Anyway you do it, a successful attacker will compromise your code base:

  • if you have your code stored in the repository as plain text, an attacker with repository read access can get all your code
  • if you have your code stored obfuscated in the repository, every developer will need to undo the obfuscation on their workstations (so that they can work on it); an attacker can just gain access to one developer's computer and get the code from there

If you have trust issues with your developers then you need to think differently and treat the issue as defending against insider threats. That's a difficult issue to solve outside of a justified environment (e.g. government agencies). However, a start would be to compartmentalize or minimize the access that the developers have to the code. That is, developers should only have access to the code base on which they're working on - there's no reason for them to have access to the whole code base. As such, should someone steal your code, they would only have bits and pieces and not the whole story.

Improve this answer
1
  • 1
    There is of course good reason to have access to the whole code base. The question is how do you why the cost of denying that access against the risk of your code base being copied.
    – gnasher729
    Commented Nov 29, 2022 at 16:33
0

In the case of C/CPP you opt for obfuscation in order to make it harder for adversaries to read the source code when the binary artifact is de-compiled.

You don't want to obfuscate the code source your share with you team on repository, unless the development tool-set you have in hand, allows automation of obfuscation/ de-obfsucation.

However, you should plan this step when you build/compile your software for distribution.

Improve this answer
0
0

In the other case, where the obfuscated .C/.CPP files are stored in the version repository system, the development team would face issues such as readability and unmanageable code. Is that correct?

Yes, Obfuscation simply will not rename the variable name or method name but is also meant to add more logic like adding code flow, adding dummy codes blocks, conversion of String literals into byte code representation, Encryption of hard-coded String literals and de-compiler confusion methods together will make the obfuscation stronger.

So, what is the best means to protect & store the source code?

You can configure the obfuscation tool to your compiler to generate the obfuscated binaries. On the other hand, if you really want to encrypt the source code then you can write a script to encrypt the source code contents and just use your favorite SVN to push it to the branch. Again while pull the code, Decrypt the file using same algorithm before importing into the IDE.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .