As we kick off 2022, the adoption and use of cross-platform frameworks continues to grow within the mobile app development community. In fact, roughly one-third of mobile developers now use cross-platform technologies, and among the numerous cross-platform mobile frameworks available, Flutter has recently overtaken React Native as the most used in 2021.
The reason for Flutter adoption is clear: Organizations are constantly seeking ways to reduce expenses and create efficiency, which is driving the transition to technologies that enable development teams to build applications for multiple platforms at once without compromising on performance.
Here’s a deeper dive into why Flutter adoption is growing and the security implications for organizations.
Why Companies Are Adopting Flutter
Flutter, created by Google, is an open source framework that enables developers to build mobile, web, desktop, and embedded apps using a single codebase. For mobile Flutter apps specifically, the framework compiles Dart code (the programming language used by Flutter) into native machine code for Android and iOS.
Flutter not only streamlines development, but does so while also delivering uniform user experiences and natively compiled apps on both mobile platforms. This improves the performance and consistency of Flutter apps deployed to iOS and Android compared to other cross-platform mobile frameworks that rely on JavaScript, such as React Native and Ionic.
In short, Flutter provides developers with speed, enhanced productivity, and flexibility. This drives cost-savings and greater efficiency for mobile app publishers, leading to increased adoption of Flutter by companies across numerous industries, from financial services and healthcare to e-commerce and retail.
Flutter Apps Require Hardening Measures
While Flutter may be a more cost-effective way to build multi-platform native apps, it also includes inherent security risks that should be addressed with comprehensive code hardening and anti-tampering capabilities.
Many development teams overlook mobile application security because Flutter apps are compiled directly into native code, but this is a mistake. The reality is that malicious actors can target Flutter apps using the same techniques they use to attack traditional mobile apps, and in some situations, Flutter apps can have an even larger attack surface.
For example, the Dart code used with Flutter generates a lot of metadata, exposing sensitive information about the app’s inner workings. Reverse engineers can utilize this information to stage further attacks on the mobile app. Using code obfuscation to hide this metadata can protect Flutter apps from this static analysis.
Additionally, all Flutter apps ship with the Flutter engine, which handles user interface rendering, system I/O, and other critical tasks. A malicious actor could easily swap this engine out to generate unwanted app behavior without modifying the original source code. Runtime application self-protection (RASP) checks can detect and mitigate these types of tampering attempts.
To prevent hacking and reverse engineering, implementing protections for Flutter apps on mobile platforms is imperative, especially since it’s considered one of the most prominent frameworks amongst developers. In fact, at Guardsquare, we recognize the importance of Flutter mobile app security and recently added protective measures to our existing mobile app security suite.
Comprehensive mobile app security – whether developers build their apps using native tooling, Flutter, or another framework – should include multiple layers of code obfuscation, encryption, and RASP measures.
