Counteract app data lifting attacks

Build38 provides robust protection against security attacks that target the sensitive data handled and stored by your mobile apps. We achieve this with a unique combination of advanced mobile in-app defense features, complemented by exclusive server-side protection services.

Our active hardening server continuously strengthens local app security by verifying device binding information at all times and individualizing every app instance using cryptographic keys. Additionally, our three threat intelligence modules allow for supervised, automated, and programmed responses to attempts to extract your apps’ sensitive data.

How hackers do it

App data lifting is a tactic hackers use to surreptitiously access and exfiltrate sensitive data from mobile apps. This technique involves exploiting vulnerabilities within an app or device to gain unauthorized access to information stored in the app’s databases and local files. 

Once hackers gain access, they can copy, extract, or “lift” valuable information, including user credentials, personal data, or confidential records, which can then be exploited to commit identity theft, fraud, or gain unauthorized access to other systems.

How Build38 protects your mobile apps

Build38’s comprehensive approach to security seamlessly integrates on-device protection with cloud-based active hardening and threat intelligence mechanisms, providing a robust defense against any attempts to tamper with your app’s precious data.

Superior mobile app self-protection

Our effectiveness at countering data lifting attacks primarily stems from our comprehensive support for data security, including encryption for data at rest, in transit, and in use. These encryption services are further enhanced by our platform's inherent cryptographic key management capabilities.

Since data lifting attacks can also be initiated by tampering with an app's execution process, we also address this threat by continually monitoring app code integrity.

  • Full range of data protection services – Our in-app protection software offers a wide range of data security options that provide protection for data at rest, data in transit, and data in use. This includes options for secure but slower user data encryption as well as rapid encryption for large data volumes or application assets, all while ensuring data remains secure in memory. These services are readily available and seamlessly complemented by our native cryptographic key management support.

  • Cryptographic key management – Build38 provides robust cryptographic key management services, equipping your developers with advanced tools to strengthen data and communication security within their applications. These services encompass both client-side and server-side cryptographic utilities, utilizing a Hardware Security Model (HSM) located in our data center. Moreover, our platform incorporates a NIST-compliant Random Number Generator (RNG) to generate secure cryptographic keys, ensuring the critical elements of randomness and unpredictability required for robust cryptographic security.

Active hardening

The Active Hardening Server enhances app security remotely through cryptographic-key-based instance individualization, certificate injection into each app instance, and verification of device binding information. The combination of cryptographic-key-based individualization and robust data binding acts as a potent deterrent against app data lifting. Additionally, the Active Hardening Server collects app security data from individual devices, including suspected data lifting activities, and utilizes a machine learning engine to derive comprehensive threat intelligence.

Cloud-based threat intelligence 

Our platform channels real-time intelligence to three distinct cloud-based Threat Intelligence modules, empowering your business team and back-end software with unique methods to counteract app data lifting attacks.
Threat Intelligence Portal

Our web console promptly notifies your team when app data lifting incidents occur, allowing them to take additional action, such as permanently wiping the app, locking it, or unlocking it as necessary.

Attestation & Response

Our user-friendly online interface allows your team to easily establish automated rules without coding, ensuring that future attempts at app data lifting will be met with an appropriate response, based on predefined policies.

Threat Intelligence & Response APIs

With our APIs, you can inform your back-end systems about security incidents, including suspected app data lifting activities, and program specific responses directly into your back-end application logic itself. This facilitates rapid programmed responses against app data lifting attacks and other mobile app threats.

Why businesses choose Build38

Businesses worldwide trust Build38 with their mobile app security. Don’t just take our word for it—listen to what our customers have to say.

Discover the next generation
of mobile app security