  Android applications are frequently plagiarized or repackaged, and software
obfuscation is a recommended protection against these practices. However, there
is very little data on the overall rates of app obfuscation, the techniques
used, or factors that lead to developers to choose to obfuscate their apps. In
this paper, we present the first comprehensive analysis of the use of and
challenges to software obfuscation in Android applications. We analyzed 1.7
million free Android apps from Google Play to detect various obfuscation
techniques, finding that only 24.92% of apps are obfuscated by the developer.
To better understand this rate of obfuscation, we surveyed 308 Google Play
developers about their experiences and attitudes about obfuscation. We found
that while developers feel that apps in general are at risk of plagiarism, they
do not fear theft of their own apps. Developers also self-report difficulties
applying obfuscation for their own apps. To better understand this, we
conducted a follow-up study where the vast majority of 70 participants failed
to obfuscate a realistic sample app even while many mistakenly believed they
had been successful. Our findings show that more work is needed to make
obfuscation tools more usable, to educate developers on the risk of their apps
being reverse engineered, their intellectual property stolen, their apps being
repackaged and redistributed as malware and to improve the health of the
overall Android ecosystem.
