Obfuscating Code Vulnerabilities Against Static Analysis in Android Apps

In this paper, we investigate using obfuscation as a security-through-obscurity approach to hide app code vulnerabilities in Android apps. Obfuscation refers to a set of techniques that change the syntax of the code but preserve its semantics. This way, the app maintains the same runtime behavior, but the obfuscated code is hardly readable to a human being. Here, we aim to empirically assess whether obfuscation could also negatively affect the vulnerability detection rate of SAST (i.e., Static Application Security Testing) tools. Such tools automatically reverse-engineer the app and look for vulnerability patterns in the code according to proper heuristics. Our findings show that obfuscation reduces the detection rate of SAST tools, suggesting that investigating novel and vulnerability-focused obfuscation techniques in the future may reduce the probability of an attacker detecting vulnerabilities in obfuscated app code, both manually (due to unreadability) and automatically (by deceiving SAST tools).