Mfcttrf

I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would be able to bring the obfuscated code back into a more readable state.

However, OWASP recommends the usage of obfuscation for mobile clients, which makes me wonder if there is more credibility to obfuscation than I had given to it.

Hence my question: Does obfuscation give any measurable security benefit? Specifically, a benefit that outweighs the added cost, complexity and reduced performance.

Note: When I say "obfuscation", I am talking about deliberate steps taken to prevent reverse engineering. Compiler optimizations, even though they make the assembly less easy to read, are done for the purpose of improving performance, not to prevent reverse engineering.

There are two benefits to code obfuscation:

1. It weeds out the shallow end of the attacker pool. Script kiddies who struggle to make sense of your code will go somewhere else.


2. It increases effort required of skilled attackers. No matter how skilled they are, obfuscation is cheaper than de-obfuscation, and the result is generally less comprehensible than the original (variable names will remain generic, for example, where the originals were descriptive).

@SteveSether is doubly right in his comment - actual measurements will be almost impossible to find, and many code bases are obfuscated for proprietary reasons* rather than security reasons.

But for both security and proprietary reasons, code obfuscation's value is tied to its asymmetric quality - it's cheaper to obfuscate than it is to de-obfuscate.

*By "proprietary reasons" I mean "the desire to keep one's code and algorithms more private, or harder to reproduce, in the interest of maintaining competitive advantage in the market." Companies and individuals are both prone to this tendency.

• 
  

  As long I seen obfuscated code (mostly viruses and rootkits) on potentially everything able to recieve from Internet (mail, ftp, web, dns etc, in requests, logs, file transferts), humain time involved to deobfuscate code enough for finding essential informations like server address, admin id and hashed password for botnet or sensible strings or library calls for viruses is mostly count in minutes...

  
  
  

  So in term of protection against strange code, this is not a big job (if not trivial)

  
  



• As opposite, building editable sources from this kind of code could take a lot of time (to be count in days, week or even more if code is big. Anyway more deobfuscation process progress, more they are efficient and quick... as when light is comming...)




• About OWASP's recommendation, I agree: Obfuscation implie human ressources, so they represent some cost, making piracy less attractive.




• About measurablility of security benefit... I'm afraid, but... I can't! Depending on who could be interested by hacking your code, and why...