Because JavaScript is one of the most common programming languages, learning how to hide your JS code and the tools you can use to do that is important to keep your apps safe.
JavaScript is arguably the world's most prominent programming language. This is what makes JavaScript obfuscation a vital component and key process of modern cybersecurity.
JavaScript is distributed in source form and is therefore particularly easy to read and modify by would-be attackers. So, protecting JavaScript code has never been more important.
JavaScript possesses several features that make it unlike compiled languages. It is uniquely vulnerable because it is distributed as source. However, the dynamic nature means that advanced obfuscation techniques can be applied.
There are qualities to JavaScript as a programming language that make it easy for attackers to examine, modify, and exploit it.
JavaScript is a dynamic language with dynamic execution. This means it determines and executes different operations at runtime, like rewriting code changes. These code modifications at runtime allow obfuscators to transform and mutate code in ways that make it harder to analyze. This is one of the reasons why the nature of JavaScript gives it an advantage in code obfuscation.
The character of JavaScript code influences the attacks to which it is vulnerable and the obfuscation techniques that work best with it. Unprotected JavaScript is highly vulnerable to these kinds of cybersecurity threats:
Note: For OWASP Top 10 Mobile Risks, supply chain attacks are ranked at M2: Inadequate Supply Chain Security, while code injection attacks are mostly covered in M4: Insufficient Input/Output Validation.
Care is needed when selecting obfuscation methods. If not implemented, it could render your sensitive code vulnerable. If poorly implemented, it could negatively impact your site’s performance and prove easy to reverse. For best security, layer multiple obfuscation techniques together. And for best performance, employ different levels of obfuscation for different code parts, testing execution time in the process.
If you can read the source code, you can understand what functions JavaScript is performing. Renaming classes, function names, and other variables makes their function less obvious and slows down analysis. This is why it is sometimes called variable renaming.
Renaming is often used by code optimisers to make code smaller. This has a useful obfuscation side-effect. However, it is always worth using a dedicated obfuscator for the following reasons:
Having clear external references in a function clearly signposts it’s functionality. Externals hidings seeks to hide these so as to obscure the purpose of the function.
This hides ("encodes") the string literals in the code into an alternative encoding scheme from which little meaning can be inferred.
Operator removal replaces numerical, logical and conditional operators in the code with functions that perform the same operations. These function calls are then inserted in the place of the original operator thereby removing meaning from the code.
These are random checks inserted into the control flow processing to prevent unauthorized modification. Detection of modified code leads to breaking the control flow of the application and a random crash, often presented as an out-of-memory error.
Let us talk about what obfuscated JavaScript looks like.
In this example, string literals have been replaced by functions that reconstruct the strings.
This is an example of what code configured by renaming might look like after symbol names have been replaced with meaningless identifiers.
These are a few simple examples. Realistically, several more obfuscation passes are typically applied for a more complete result.
We’ll look at some free code obfuscation tools for JavaScript and evaluate their worth against solutions that require purchasing.
obfuscation.io is a free, open source JavaScript obfuscator tool with a focus on transforming strings and identifiers. It also enables other transformations, such as control flow flattening and dead code injection, as well as some minification and beatification type options.
Terser is a free and open source minifier and mangler for JavaScript code that shrinks variable names, removes whitespace and comments, and drops unused code. It lacks control flow flattening, string encoding, or self-defending.
UglifyJS is a free JavaScript parser, minifier, compressor and beautifier toolkit. It lacks lacks anti-debugging, control flow flattening, and string encoding options.
GutHib has a free, open-source, configurable obfuscator for JavaScript. GitHub also offers JStillery - a tool that uses partial evaluation to deobfuscate JavaScript code.
JS-Confuser is a free, open-source JavaScript obfuscator tool that makes programs impossible to understand, copy, re-use or modify without authorization.
There are some practical issues that deserve a mention when selecting and employing an obfuscation tool for JavaScript.
Sourcemaps are a debugging aid that map the obfuscated code back to the original source location. It is unlikely that open source tools will have sourcemap support. Instead, select a tool that can produce a sourcemap file for every obfuscated file to aid in the debugging of crash reports from obfuscated code.
Is the tool cloud-hosted or an on-premise solution? If the solution is fully on-premise, it can be easily integrated into CI/CD pipelines. But if the tool is only web-based, then code obfuscation may require manual intervention. Also, if the code is particularly sensitive, you may not want it to leave your premises until it's obfuscated. An on-premise tool means there there is no need to share the code offsite.
If you are developing a hybrid app – as opposed to a native one in Android or iOS – then employing an obfuscation solution to make vulnerable JavaScript code difficult to read and debug is a security must. Also, use a product on your hybrid mobile app containing JavaScript that automatically obfuscates it as part of the protection process.
Book at meeting with us today to talk about how we can help protect your mobile device from security threats. Whether your concern lies with JavaScript or elsewhere, we have a solution that fits your industry, your team, and your app.