APK Image Loading Problem

[chris_ccf_6b]

I have rooted my android device. And I just has a view to my made APK through Corona.

I found that the image for constructing the app GUI display can be read directly from the root browser.

I wonder if there is way to encrypt the photo to raw byte and then display them after decryption?

I just need a bit more security. I do not want everyone with a rooted device can view/copy my graphics in this easy way.

[_memo]

You can not in any practical way prevent people from accessing the assets (images/sounds) in your app. You simply have to accept the fact that they can be harvested. Encryption won’t help because you need a key to decrypt, and if you store that key in the app’s database or source code, the key will also be accessible to a hacker.

It’s a lost cause, similar to how the music industry tried to prevent people from copying CDs. If you can listen to the music, you can copy it. If you can view the images in an app, you can copy them.

[chris_ccf_6b]

Thank you very much for your reply. Piracy is always a headache to designer.

In my case, the game is a server-client type. I planned to store the key in the server side.  When the game needed to decrypt the art works, server will deliver the key to client.

Could you suggest a method so that I can do this encryption in client side for the art works (image)? 

(encrypted image => decrypted image => display)

[_memo]

Unfortunately, storing the key on the server doesn’t necessarily help either.

• If the app needs to provide credentials to get the key, then those credentials have to be stored in the app, and you’re back where you started
• If the app can download the key from the server without providing credentials, then the key is publicly available to everyone on the internet, and you’re also back where you started
• If the user needs to enter a password when they start the app, then you have some actual security! But – I don’t think it is technically possible to load images from anything other than a file in Corona, as display.newImage / newImageRect only take file locations as parameters, not streams, byte arrays etc. Meaning you can’t decrypt files before creating display objects from them.

[corona273]

_memo’s advice is on-point. You should probably not waste your time on this. But if you want to try to make it harder for an attacker:

* You could download the images to a file, and in the listener delete them immediately after rendering. There’s still a small window of time a sufficiently determined attacker would have to grab it pre-deletion.

* You could store the images in encrypted form, and decrypt them (you probably still have the temp file problem) with a key in your app. You’d have to obfuscate your Lua code (http://www.capprime.com/CapprimeLuaObfuscator/CapprimeLuaObfuscator.aspx) and your key-derivation algorithm – this kind of anti-piracy technique goes back at least to the 1980s. You can’t prevent a sufficiently determined attacker from extracting the art, but you can raise their costs.

[chris_ccf_6b]

Thank you for your replies. Your sharing is inspiring me about security issue.

But I still have some doubts. Please help me out.

_memo:

  I think you opinion is quite right. Maybe I can just raise the cost of attacker as corona273 mentioned.

  I just wonder why unity provide unity3d format to store the assets? Do you think this level of security is really do something? I just feel not uncomfortable to expose my art works in such a direct way…

corona273:

  Thank you for suggesting me the method. And I have tried your method. However, I found that corona do not allow me to delete the image file after I rendered to the display. [I used os.remove()]

  I can just remove the image file after I “destroy” the display object [by display.remove].

  This mean I have to expose my work during the time of displaying the image on screen but not just expose a while during the time of rendering.

  Am I right? Or corona has better API I missed?

[corona273]

If you can’t remove a file, perhaps you can corrupt it? 

But note: “This means if an image file is displayed and then deleted from the directory, any file loaded after that with the same file name will still display the previous cached image” http://docs.coronalabs.com/api/library/display/newImageRect.html

My hunch, though, is that if you’re so stressed out about this topic, and you’re finding your choice of development environment is working against you this much, Corona may not be the best solution for you.

[chris_ccf_6b]

Thank you corona273.

I think corona is still worth to use in my project. I am finding ways to handle this problem. Your suggestion is nice to me.

[_memo]

You can not in any practical way prevent people from accessing the assets (images/sounds) in your app. You simply have to accept the fact that they can be harvested. Encryption won’t help because you need a key to decrypt, and if you store that key in the app’s database or source code, the key will also be accessible to a hacker.

It’s a lost cause, similar to how the music industry tried to prevent people from copying CDs. If you can listen to the music, you can copy it. If you can view the images in an app, you can copy them.

[chris_ccf_6b]

Thank you very much for your reply. Piracy is always a headache to designer.

In my case, the game is a server-client type. I planned to store the key in the server side.  When the game needed to decrypt the art works, server will deliver the key to client.

Could you suggest a method so that I can do this encryption in client side for the art works (image)? 

(encrypted image => decrypted image => display)

[_memo]

Unfortunately, storing the key on the server doesn’t necessarily help either.

• If the app needs to provide credentials to get the key, then those credentials have to be stored in the app, and you’re back where you started
• If the app can download the key from the server without providing credentials, then the key is publicly available to everyone on the internet, and you’re also back where you started
• If the user needs to enter a password when they start the app, then you have some actual security! But – I don’t think it is technically possible to load images from anything other than a file in Corona, as display.newImage / newImageRect only take file locations as parameters, not streams, byte arrays etc. Meaning you can’t decrypt files before creating display objects from them.

[corona273]

_memo’s advice is on-point. You should probably not waste your time on this. But if you want to try to make it harder for an attacker:

* You could download the images to a file, and in the listener delete them immediately after rendering. There’s still a small window of time a sufficiently determined attacker would have to grab it pre-deletion.

* You could store the images in encrypted form, and decrypt them (you probably still have the temp file problem) with a key in your app. You’d have to obfuscate your Lua code (http://www.capprime.com/CapprimeLuaObfuscator/CapprimeLuaObfuscator.aspx) and your key-derivation algorithm – this kind of anti-piracy technique goes back at least to the 1980s. You can’t prevent a sufficiently determined attacker from extracting the art, but you can raise their costs.

[chris_ccf_6b]

Thank you for your replies. Your sharing is inspiring me about security issue.

But I still have some doubts. Please help me out.

_memo:

  I think you opinion is quite right. Maybe I can just raise the cost of attacker as corona273 mentioned.

  I just wonder why unity provide unity3d format to store the assets? Do you think this level of security is really do something? I just feel not uncomfortable to expose my art works in such a direct way…

corona273:

  Thank you for suggesting me the method. And I have tried your method. However, I found that corona do not allow me to delete the image file after I rendered to the display. [I used os.remove()]

  I can just remove the image file after I “destroy” the display object [by display.remove].

  This mean I have to expose my work during the time of displaying the image on screen but not just expose a while during the time of rendering.

  Am I right? Or corona has better API I missed?

[corona273]

If you can’t remove a file, perhaps you can corrupt it? 

But note: “This means if an image file is displayed and then deleted from the directory, any file loaded after that with the same file name will still display the previous cached image” http://docs.coronalabs.com/api/library/display/newImageRect.html

My hunch, though, is that if you’re so stressed out about this topic, and you’re finding your choice of development environment is working against you this much, Corona may not be the best solution for you.

[chris_ccf_6b]

Thank you corona273.

I think corona is still worth to use in my project. I am finding ways to handle this problem. Your suggestion is nice to me.