0

How important is it to humanize the mobile-app registration process in order to prevent bot registrations? I was under the impression that CAPTCHA, probably the leading technology in this space, was made exclusively for computer-based web browsers because, unlike mobile apps that don't expose source code, web browsers do expose source code. Therefore, is a technology like CAPTCHA, or the general process of humanizing registrations, for mobile apps even necessary?

4
  • Google provides a library + service for Android apps named SafetyNet reCAPTCHA, so not all captcha target web.
    – Robert
    Commented Feb 27, 2022 at 20:29
  • @Robert To be fair, just because mitigation exists for something doesn't mean it is common enough to be worth protecting (abundance of caution and all that), but you are right that not all CAPTCHAs target webapps
    – belkarx
    Commented Feb 27, 2022 at 21:34
  • 1
    Those apps need to make calls to web services, right? If you don't have a captcha, it's trivial to automate
    – user163495
    Commented Feb 28, 2022 at 0:50
  • What @MechMK1 said. In the end, it's just code interacting with some web service. Sure, it's not the same level of simplicity as F12 or view-source, but not much harder for someone who knows what they're doing. You should assume the attacker/bot has your source code and knows the APIs (only one device needs to be jailbroken/rooted/emulated to observe exactly what's going on). This is very hard to get right, and you'd probably need some out-of-band provisioning.
    – domen
    Commented Mar 1, 2022 at 16:08

1 Answer 1

1

It is somewhat less efficient to create bots targeting mobile applications, however it is not something you should overlook. Many APKs, especially those written in Java, are trivial to reverse, so the source code argument doesn't hold up (it's just slightly more inconvenient for attackers, but presumably worthwhile if they're bothering to write a bot).

Also, anything can be automated, not necessarily directly through code, as you can just emulate device input (in a way similar to that of Autohotkey, or more relevantly, xdotool for Linux and X11-based devices, ie Android) exist.

So, if there is motivation for bots to be released on a mobile app, it can be done with similar ease to that of web applications, and protection is important.

5
  • Assume the source code couldn't be decompiled (which I think is the case for iOS apps), how would an attacker then make a bot? Would they have to emulate the app onto a computer? Or could they jailbreak the phone's OS and run a bot on the phone that controls other apps? Commented Feb 27, 2022 at 23:45
  • @kidcoder Both of those are viable options, but realistically emulation is the way to go (jailbreaking iphones is getting more and more difficult).
    – belkarx
    Commented Feb 28, 2022 at 0:09
  • 1
    Also, unless your registration flow involves some cryptographic secret that isn't transmitted over the wire directly, of you're using certificate/public key pinning, it's easy to write a bot for your mobile registration without any decompiling at all. Just use an intercepting proxy (with your own root CA cert installed on the device) to read the traffic to and from the app. It's usually trivial to learn how to imitate that traffic.
    – CBHacking
    Commented Feb 28, 2022 at 6:14
  • @CBHacking the backend in my specific use case is Firebase which requires that only API calls from iOS devices are allowed, specifically those with the proper security keys in the app's bundle (the compiled exe file). I imagine that is rather difficult to intercept and sufficient to keep bots out? Commented Feb 28, 2022 at 17:48
  • 1
    Depends how the keys are used, among other things. Intercepting is often still easy but if the key is used to sign or MAC messages then it's harder to spoof, especially if they also thought to include replay protections. On the other hand, iOS apps aren't that hard to disassemble (harder than Andoid ones but still not actually hard) and there are a few ways that somebody might get access to the binaries.
    – CBHacking
    Commented Mar 1, 2022 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .