安全分析报告： MobileWips v1.2.01.17

安全分数


安全分数 52/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

0

用户/设备跟踪器


调研结果

高危 1
中危 8
信息 1
安全 1
关注 1

高危 应用程序在加密算法中使用ECB模式。ECB模式是已知的弱模式，因为它对相同的明文块[UNK]产生相同的密文 

应用程序在加密算法中使用ECB模式。ECB模式是已知的弱模式，因为它对相同的明文块[UNK]产生相同的密文
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode

Files:
org/b/a/a.java, line(s) 26,26

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 Content Provider (com.samsung.android.server.wifi.mobilewips.SemMobileWipsProvider) 受权限保护, 但是应该检查权限的保护级别。 

Permission: com.samsung.permission.WIFI_WIPS [android:exported=true]
发现一个 Content Provider被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/samsung/android/server/wifi/mobilewips/d/b/a.java, line(s) 159
com/samsung/android/server/wifi/mobilewips/i/f.java, line(s) 22

中危 IP地址泄露 

IP地址泄露


Files:
com/samsung/android/server/wifi/mobilewips/b/c.java, line(s) 91,284
com/samsung/android/server/wifi/mobilewips/d/a.java, line(s) 43,44,54,55,239,243,822,822,826
com/samsung/android/server/wifi/mobilewips/d/e.java, line(s) 87,88

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/samsung/android/server/wifi/mobilewips/a/e.java, line(s) 13
com/samsung/android/server/wifi/mobilewips/d/e.java, line(s) 25
com/samsung/android/server/wifi/mobilewips/d/f.java, line(s) 23
com/samsung/android/server/wifi/mobilewips/d/l.java, line(s) 21
com/samsung/android/server/wifi/mobilewips/i/i.java, line(s) 3
com/samsung/android/server/wifi/mobilewips/i/k.java, line(s) 6
org/jsoup/helper/DataUtil.java, line(s) 14

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
org/jsoup/helper/W3CDom.java, line(s) 29
org/jsoup/nodes/Comment.java, line(s) 8
org/jsoup/nodes/DocumentType.java, line(s) 10,11,13

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/samsung/android/server/wifi/mobilewips/SemMobileWipsProvider.java, line(s) 9,10,11,12,176,220,260

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
gD63hSj3ScS+wuOeGrubXlq35N1c5Lby/S+T7MNTjxo=
etPaaIxcBMY1oUeGpwvPMCJMwlRVNxv51KK/tktoJTQ=
a3785913ca4deb75abd841414d0a700098e879777940c78c73fe6f2bee6c0352
AW5uAoTSTDfG5NfY1bTh08GUnOqlRb+HVhbJ3ODJvsE=
b0a00e4a271beec478e42fad0618432fa7d7fb3d99004d2b0bdfc14f8024832b

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
com/samsung/android/server/wifi/mobilewips/SemMobileWipsProvider.java, line(s) 41,72,323,356,373,380,410,419,434,459,49,64,80,161,196,207,240,251,280,291,314,317,384,423,447,450,99,117,157,165,168,363,90,187,231,271,303,346
com/samsung/android/server/wifi/mobilewips/SemMobileWipsService.java, line(s) 225,233,192,190,200,238,40,78,150
com/samsung/android/server/wifi/mobilewips/a.java, line(s) 103,109,141,149,191,223,234,80,92
com/samsung/android/server/wifi/mobilewips/a/a.java, line(s) 84,273,140,151,187,210,136,157,233,116,162
com/samsung/android/server/wifi/mobilewips/a/c.java, line(s) 43,52,59,66,86
com/samsung/android/server/wifi/mobilewips/a/d.java, line(s) 16,20
com/samsung/android/server/wifi/mobilewips/a/e.java, line(s) 140,145,149,165,171,176,184,112,240
com/samsung/android/server/wifi/mobilewips/a/h.java, line(s) 119,164,54,130,135,141
com/samsung/android/server/wifi/mobilewips/b.java, line(s) 205,214,45,53,59,64,172,174,178,201,203,238,304,321,324,327,390,395,402,457,476,483
com/samsung/android/server/wifi/mobilewips/b/a.java, line(s) 169,187,268,278,292,358,321
com/samsung/android/server/wifi/mobilewips/b/b.java, line(s) 35,32
com/samsung/android/server/wifi/mobilewips/b/c.java, line(s) 235,351,356,359,203,215,254,272,133,314,340,345
com/samsung/android/server/wifi/mobilewips/c.java, line(s) 84,131,284,99,146,159,202,260,106,113,118,122,170,247,249,287,70,91,126,168
com/samsung/android/server/wifi/mobilewips/d/a.java, line(s) 628,256,297,435,441,573,669,683,693,722,731,795,829,839,171,172,212,265,303,311,314,317,320,326,329,517,519,565,197,210,214,305,364,531,570,592,597,664,816,837
com/samsung/android/server/wifi/mobilewips/d/a/a.java, line(s) 346
com/samsung/android/server/wifi/mobilewips/d/a/d.java, line(s) 327
com/samsung/android/server/wifi/mobilewips/d/b.java, line(s) 27,30
com/samsung/android/server/wifi/mobilewips/d/b/a.java, line(s) 108,114,119,123,39,81,126
com/samsung/android/server/wifi/mobilewips/d/b/c.java, line(s) 24,33,64,78
com/samsung/android/server/wifi/mobilewips/d/e.java, line(s) 231,240,241,324,332,489,277,394,137,164,171,175,199,265,349,355,484,490,500,513,514,526,527,564,214,221,284,357
com/samsung/android/server/wifi/mobilewips/d/f.java, line(s) 348,351,63,71
com/samsung/android/server/wifi/mobilewips/d/g.java, line(s) 141,160,24,63,112,117,123,183,30,166,179
com/samsung/android/server/wifi/mobilewips/d/h.java, line(s) 363,366,443,448,454,630,656,170,242,394,67,105,210,247,275,313,320,349,388,391,410,417,421,531,542,665,680,685,698,173,200,204,214,219,223,227,231,235,264,309,328,354,382,403,414,426,464,700
com/samsung/android/server/wifi/mobilewips/d/i.java, line(s) 47,54,64,72,174,141,171,195,236,271,131,200,312,317,399
com/samsung/android/server/wifi/mobilewips/d/j.java, line(s) 98,107,114,136,149,155,161,173,181,187,194,199,213,223,230,235,246,255,276,289,295,309,315,330,336,348,365,374,380,386,69,242,82,85,95
com/samsung/android/server/wifi/mobilewips/d/k.java, line(s) 184,190,61,85,42,51
com/samsung/android/server/wifi/mobilewips/d/l.java, line(s) 544,545,358,379,408,455,471,318,329,336,503,509,514,599,608,612,534,566,593,624
com/samsung/android/server/wifi/mobilewips/d/m.java, line(s) 94,140,149,157,160,168,175,211,217,222,229,234,243,251,295,300,321,332,340,350,363,394,408,413,418,458,484,495,499,505,509,519,557,568,596,602,619,428,465,576,636,260,288,317,534,273,360,373,376,386,582
com/samsung/android/server/wifi/mobilewips/e/a.java, line(s) 14
com/samsung/android/server/wifi/mobilewips/e/b.java, line(s) 111,114,127,132,137,142
com/samsung/android/server/wifi/mobilewips/g/a/a.java, line(s) 71,88,101
com/samsung/android/server/wifi/mobilewips/h/a.java, line(s) 109,46,64,68,71,106
com/samsung/android/server/wifi/mobilewips/h/b.java, line(s) 112,369,71,90,98,130,203,223,298,310,333,362,390,422,77,84,101,145,182,197,217,313,327,379,87,104,200,220,316,330
com/samsung/android/server/wifi/mobilewips/i/e.java, line(s) 156,168
com/samsung/android/server/wifi/mobilewips/i/f.java, line(s) 56,183,190,215,265,289,292,295,305,311,314,51,93,106,116,166,171,182,205,214,238,243,251,321,324
com/samsung/android/server/wifi/mobilewips/i/g.java, line(s) 48,19
com/samsung/android/server/wifi/mobilewips/i/h.java, line(s) 43,67,84,105
com/samsung/android/server/wifi/mobilewips/j/a.java, line(s) 27,85
com/samsung/android/server/wifi/mobilewips/j/b.java, line(s) 149,300,326,330,409,101,122,146,245,248,337,356,370,374,423,204,340,367,383,389,401,414
com/samsung/android/server/wifi/mobilewips/j/c.java, line(s) 20,22
com/samsung/android/server/wifi/mobilewips/j/d.java, line(s) 25,80
com/samsung/android/server/wifi/mobilewips/j/e.java, line(s) 111,169,105,177,183,421,475,341
com/samsung/android/server/wifi/mobilewips/j/f.java, line(s) 56
com/samsung/android/wifi/FrameworkService.java, line(s) 49,61,66,84,136,145,152,159,169,176,210,222,229,243,252,259
com/samsung/android/wifi/SemMobileWipsWifiSsid.java, line(s) 50

安全 此应用程序没有隐私跟踪程序 

此应用程序不包括任何用户或设备跟踪器。在静态分析期间没有找到任何跟踪器。

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.samsung.com) 通信。 

{'ip': '61.147.219.216', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '南通', 'latitude': '32.030296', 'longitude': '120.874779'}

安全评分: ( MobileWips 1.2.01.17)