Your intellectual property could be at risk: Protect it with Obfuscation

As a software publisher, the intellectual property driving your application is the lifeblood of your company. What many developers do not realize is that in some cases the code behind an application can be recovered back into source code form within minutes. That makes it surprisingly easy for someone to crack your software and distribute it for free, or even sell it as their own.

No software or system is completely impervious to attack. That is the unfortunate truth. However, there are reasonable measures you can take to mitigate the risk of your intellectual property being reverse engineered or stolen, and obfuscation is one tool that plays a critical role in doing so.

What is obfuscation?

In the context of software, obfuscation is the act of concealing (or "obscuring") source code or machine code so that it is difficult for humans to understand. Obfuscation is always relevant to protecting intellectual property, but its importance and how it is applied depend on the language or framework used to build your application.

The languages used to write applications fall into three high-level categories: interpreted languages, intermediate languages, and native languages. Each category carries a different level of risk.

Interpreted languages

Interpreted languages are run directly by an interpreter. Examples include Perl, PHP, PowerShell, and VBScript. With these languages, the code written by a human is read by an interpreter, which then carries out the instructions.

In other words, sending someone a program written in one of these languages is essentially the same as sending the source code. For this reason, using a tool that obfuscates the source code is extremely important when that code contains sensitive information or logic.

Intermediate languages

Intermediate languages are a specific type of interpreted language. The code written by a human is first "compiled" into intermediate language code. When the program runs, an interpreter reads the intermediate language code and carries out the instructions. Examples include .NET languages (C#, VB.NET, and others) and Java.

Because tools are available to revert (or "de-compile") intermediate language code back to a form close to what the developer originally wrote, distributing a program written in these languages carries the same risks as distributing the source code. This makes obfuscation a very important tool whenever the source code contains sensitive information or logic.

Native languages

Although the term "compiled language" is more commonly used here, we deliberately use a different term to exclude intermediate languages. Native languages (such as C and C++) are those in which source code written by a human is compiled into machine code. Because machine code is more cumbersome and difficult for humans to read, it is much harder to reverse engineer and copy. Machine code is also very difficult to revert back to its original source form.

Despite the added difficulty, it is still possible to follow the logic of native programs by tracing the instructions being run. The number and types of security features available also vary based on the compiler (and compiler version) used, the processor architecture, and the operating system version. For these reasons, it is still important to obscure an application's most sensitive information and logic.

Where do I start?

The simplest place to start is with an obfuscator, which is a tool that automatically obfuscates source code for you. For interpreted and intermediate languages, the available tools vary based on the language used. For native languages, automatic obfuscation is usually a feature of a different type of tool known as a "packer."

A note for developers

It can be critical to adjust your programming practices to get the most out of an obfuscator. For example, it is common to make code publicly accessible (so other programs can see it and call it) for unit testing purposes. The drawback is that an obfuscator cannot mangle or randomize the name of something that is exposed publicly, even when that code is not really meant to be called from outside your own source. Keeping the public surface of your code as small as possible gives the obfuscator more to work with.

Manual obfuscation

Manual obfuscation is when you or your developer deliberately obfuscate code or data to make sensitive information and logic harder to find and reverse. Even when you use an automatic obfuscator, manual obfuscation can be valuable, because even obfuscated code can potentially be reversed (or de-obfuscated).

Manually obfuscated code is often best paired with an automatic obfuscator. On its own, a single hand-obfuscated routine can stand out as an obvious target when it sits next to un-obfuscated code. A typical example of what you might obfuscate manually is private or secret encryption key data and the logic that uses it.

Because manual obfuscation inherently makes source code more complicated, use your best judgment to ensure the obfuscated code remains maintainable and does not significantly affect your application's performance.

Summary

Obfuscation plays a pivotal role in protecting your software from reverse engineering and intellectual property theft. Keep in mind that it should be one of many tools you use for this purpose. It does not serve as a substitute for other safeguards such as encryption and integrity verification.

If you use a licensing system, obfuscation also helps protect the way your application integrates with that system, making it harder for an attacker to locate and tamper with the code that enforces your licensing. Used together with encryption, verification, and a robust licensing implementation, obfuscation is an important layer in a defense-in-depth approach to safeguarding your intellectual property.