Question

The tips in the Security and Design document for Android’s In-app Billing state that:

In particular, attackers look for known entry points and exit
points in an application, so it is important that you modify these
parts of your code that are identical to the sample application.

Since I am going to use In-app Billing for the first time, I am very much interested in understanding what this means exactly, in terms of securing my subscription-based app:

1. What are exactly those “known entry/exit points”?
2. What do I need to modify in these parts, to make the task of an
   attacker more difficult?
3. Given the fact that nothing can be protected from eventual reverse-engineering, is it really worth it to go to such great length to protect an
   application/service?

Answer 1

I think that document is talking about the methods that are standard in Android for starting an application, namely the activity lifecycle methods (onCreate, etc.). These are easy for attackers to find because they aren’t obfuscated (since the framework needs to be able to find them).