Addressing OWASP MASVS-R with Jscrambler

8.1

The app detects and responds to the presence of a rooted or jailbroken device either by alerting the user or terminating the app.

Jscrambler’s Root/Jailbreak detection feature detects these risky devices and can alert the user, terminate the app, or block features.

8.2

The app prevents debugging and/or detects and responds to a debugger being attached. All available debugging protocols must be covered.

Provides multiple anti-debugging features, including Self-Defending and Dead Objects, which actively prevent debugging at runtime, breaking the app when a debugger is opened.

8.3

The app detects and responds to tampering with executable files and critical data within its own sandbox.

Jscrambler’s Self-Defending and Self-Healing features prevent tampering attempts at runtime, both by breaking the app or only allowing the correct code to run.

8.4

The app detects and responds to the presence of widely used reverse engineering tools and frameworks on the device.

Jscrambler’s Code Hardening feature is built-in for every code protection and provides up-to-date protection against all reverse engineering tools.

8.5

The app detects and responds to being run in an emulator.

Jscrambler’s Code Hardening feature provides anti-emulator capabilities. It detects if the source code is being executed by, e.g., Facebook's (Meta) pre-pack custom JavaScript engine.

8.6

The app detects and responds to tampering with the code and data in its own memory space.

Jscrambler’s Self-Defending and Self-Healing features prevent tampering attempts at runtime. The Memory Protection feature ciphers sensitive data using cryptographic algorithms, preventing values stored in memory from being accessed and tampered with at runtime.

8.7

The app implements multiple mechanisms in each defense category (8.1 to 8.6). Note that resiliency scales with the amount and diversity of the originality of the mechanisms used.

Under the hood, Jscrambler uses multiple defense mechanisms, including different ways to detect debugging and tampering attempts and to detect if the device is rooted or jailbroken.

8.8

The detection mechanisms trigger responses of different types, including delayed and stealthy responses.

Jscrambler combines different approaches to prevent tampering and debugging attempts, including customizable countermeasures and real-time security alerts.

8.9

Obfuscation is applied to programmatic defenses, which in turn impede de-obfuscation via dynamic analysis.

Jscrambler’s polymorphic obfuscation is applied to all anti-tampering and anti-debugging defenses, making it extremely hard for attackers to de-obfuscate the code both using static and dynamic analysis.

8.10

The app implements device binding functionality using a device fingerprint derived from multiple properties unique to the device.

Device binding can be obtained using Jscrambler’s integrations with native code protection technologies.

8.11

All executable files and libraries belonging to the app are either encrypted on the file level, and important code and data segments inside the executables are encrypted or packed. The trivial static analysis does not reveal important code or data.

While Jscrambler obfuscates JavaScript source code, it can also encrypt native code through dedicated integrations with native code protection technologies.

8.12

If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods. The effectiveness of the obfuscation scheme must be verified through manual testing.

Jscrambler provides over 35 different transformations, along with polymorphic behavior, to greatly improve the resiliency of the protected source code against manual and automated de-obfuscation. The effectiveness of the obfuscation can be analyzed by following this checklist.

8.13

As a defense in depth, in addition to having solid hardening of the communicating parties, application-level payload encryption can be applied to further impede eavesdropping.

This level of encryption can be obtained using Jscrambler’s integrations with native code protection technologies.