OWASP MASVS-R, the Mobile Application Security Verification Standard, is an optional protective layer that helps impede reverse engineering and tampering.
In this article, learn how to address OWASP MASVS-R with Jscrambler, a standard that helps developers improve mobile app security by outlining requirements an application should follow.
Exploring OWASP MASVS-R
As a standard, MASVS provides a list of requirements an application should follow. There are two security levels: MASVS-L and MASVS-R.
1. MASVS-L
The first security level is divided into L1, which contains generic security requirements recommended for all apps, and L2, which contains defense-in-depth requirements.
2. MASVS-R
MASVS-R is the second security level and includes a set of reverse-engineering requirements that help provide client-side defenses.
This approach lets us address client-side security in more depth by defining how Jscrambler can help meet each OWASP requirement.
Although the MASVS-R is a separate level for client-side attacks, L1- and L2-compliant apps can still use the R level.
Tampering, debugging, and reverse engineering of the application’s source code are some of the attacks covered by OWASP’s MASVS-R.
This kind of protection is especially important for hybrid mobile apps because the application packages typically contain a JavaScript bundle file with the app’s logic.
These applications are stored on the end user’s device.
Addressing OWASP MASVS-R with Jscrambler solution
MASVS-R covers attacks such as tampering, debugging, and reverse engineering of the app’s source code.
This client-side JavaScript is easy to target, as anyone can debug and even modify it.
Companies’ proprietary algorithms and logic run in an adversarial environment, opening the door to attacks such as automated abuse, piracy, intellectual property theft, and data exfiltration.
This highlights the importance of adding a security layer to reduce the app’s attack surface.
OWASP recommends adopting the R level together with L1 or L2. In the table below, see how to address MASVS-R with Jscrambler, both at the app’s JavaScript layer and in its native code.
| MASVS-R # | OWASP Description | How Jscrambler Addresses |
|---|---|---|
| 8.1 | The app detects and responds to a rooted or jailbroken device by alerting the user or terminating the app. | Jscrambler’s Root/Jailbreak detection feature detects these risky devices and can alert the user, terminate the app, or block features. |
| 8.2 | The app prevents debugging and/or detects and responds to a debugger being attached. All available debugging protocols must be covered. | Provides multiple anti-debugging features, including Self-Defending and Dead Objects, which actively prevent debugging at runtime, breaking the app when a debugger is opened. |
| 8.3 | The app detects and responds to tampering with executable files and critical data within its own sandbox. | Jscrambler’s Self-Defending and Self-Healing features prevent runtime tampering attempts, either by breaking the app or by allowing only the correct code to run. |
| 8.4 | The app detects and responds to widely used reverse engineering tools and frameworks on the device. | Jscrambler’s Code Hardening feature is built-in for every code protection and provides up-to-date protection against all reverse engineering tools. |
| 8.5 | The app detects and responds to being run in an emulator. | Jscrambler’s Code Hardening feature provides anti-emulator capabilities. It detects if the source code is being executed by, e.g., Facebook’s (Meta) pre-packed custom JavaScript engine. |
| 8.6 | The app detects and responds to tampering with the code and data in its own memory space. | Jscrambler’s Self-Defending and Self-Healing features prevent runtime tampering attempts. The Memory Protection feature encrypts sensitive data using cryptographic algorithms, preventing runtime access to and tampering with values stored in memory. |
| 8.7 | The app implements multiple mechanisms in each defense category (8.1 to 8.6). Resiliency scales with the number and diversity of the mechanisms used. | Under the hood, Jscrambler uses multiple defense mechanisms, including different ways to detect debugging and tampering attempts and to detect if the device is rooted or jailbroken. |
| 8.8 | The detection mechanisms trigger different types of responses, including delayed and stealthy ones. | Jscrambler combines different approaches to prevent tampering and debugging attempts, including customizable countermeasures and real-time security alerts. |
| 8.9 | Obfuscation is applied to programmatic defenses, which in turn impede de-obfuscation via dynamic analysis. | Jscrambler’s polymorphic obfuscation is applied to all anti-tampering and anti-debugging defenses, making it extremely hard for attackers to de-obfuscate the code using both static and dynamic analysis. |
| 8.10 | The app implements device binding using a device fingerprint derived from multiple device-specific properties. | Device binding can be obtained using Jscrambler’s integrations with native code protection technologies. |
| 8.11 | All executable files and libraries belonging to the app are either encrypted at the file level, or important code and data segments inside the executables are encrypted or packed. The trivial static analysis does not reveal important code or data. | While Jscrambler obfuscates JavaScript source code, it can also encrypt native code through dedicated integrations with native code protection technologies. |
| 8.12 | If the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appropriate for the particular task and robust against manual and automated de-obfuscation methods. The effectiveness of the obfuscation scheme must be verified through manual testing. | Jscrambler provides over 35 different transformations, along with polymorphic behavior, to greatly improve the resiliency of the protected source code against manual and automated de-obfuscation. You can analyze the effectiveness of the obfuscation using this checklist. |
| 8.13 | As a defense-in-depth measure, in addition to hardening the communicating parties, application-level payload encryption can further impede eavesdropping. | This level of encryption can be obtained using Jscrambler’s integrations with native code protection technologies. |
This information is important not only for compliance but also to ensure your apps are fully protected against client-side threats.
If you are building mobile apps with JavaScript, you should secure your source code against theft and reverse engineering. Start a free Jscrambler trial and protect your code in 2 minutes!
