移动应用安全检测报告： Blades of Deceron v0.1.5

安全基线评分


安全基线评分 36/100

综合风险等级


风险等级评定

  1. A
  2. B
  3. C
  4. F

漏洞与安全项分布（%）


隐私风险

4

检测到的第三方跟踪器数量


检测结果分布

高危安全漏洞 4
中危安全漏洞 11
安全提示信息 1
已通过安全项 0
重点安全关注 0

高危安全漏洞 Activity (com.unity3d.player.UnityPlayerActivity) 的启动模式非 standard 

Activity 启动模式设置为 "singleTask" 或 "singleInstance" 时，可能成为根 Activity，导致其他应用可读取调用 Intent 内容。涉及敏感信息时应使用 "standard" 启动模式。

高危安全漏洞 Activity (com.google.android.gms.ads.NotificationHandlerActivity) 的启动模式非 standard 

Activity 启动模式设置为 "singleTask" 或 "singleInstance" 时，可能成为根 Activity，导致其他应用可读取调用 Intent 内容。涉及敏感信息时应使用 "standard" 启动模式。

高危安全漏洞 启用了调试配置。生产版本不能是可调试的 

启用了调试配置。生产版本不能是可调试的
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing

Files:
com/unity/purchasing/BuildConfig.java, line(s) 3,5

高危安全漏洞 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/unity3d/services/core/webview/WebViewApp.java, line(s) 172,9,54,60,74,111

中危安全漏洞 应用数据存在泄露风险 

未设置[android:allowBackup]标志
建议将 [android:allowBackup] 显式设置为 false。默认值为 true，允许通过 adb 工具备份应用数据，存在数据泄露风险。

中危安全漏洞 Service (androidx.work.impl.background.systemjob.SystemJobService) 受权限保护，但应检查权限保护级别。 

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
检测到  Service 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

中危安全漏洞 Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) 受权限保护，但应检查权限保护级别。 

Permission: android.permission.DUMP [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

中危安全漏洞 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) 受权限保护，但应检查权限保护级别。 

Permission: android.permission.DUMP [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

中危安全漏洞 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/unity3d/ads/core/configuration/GameServerIdReader.java, line(s) 10
com/unity3d/ads/core/data/datasource/AndroidMediationDataSource.java, line(s) 12,16
com/unity3d/ads/core/data/datasource/AndroidTcfDataSource.java, line(s) 10
com/unity3d/ads/metadata/InAppPurchaseMetaData.java, line(s) 6
com/unity3d/services/ads/gmascar/utils/ScarConstants.java, line(s) 4,5,6,7,9,10
com/unity3d/services/core/configuration/ExperimentObject.java, line(s) 7,8
com/unity3d/services/core/device/reader/DeviceInfoReaderFilterProvider.java, line(s) 11,12
com/unity3d/services/core/device/reader/JsonStorageKeyNames.java, line(s) 4,6,7,8,10,11,12,13,9,14,5,15,16,17
com/unity3d/services/core/properties/SdkProperties.java, line(s) 28

中危安全漏洞 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 530,514
com/unity3d/services/core/webview/WebView.java, line(s) 133,99

中危安全漏洞 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/unity3d/ads/core/data/datasource/AndroidStaticDeviceInfoDataSource.java, line(s) 226
com/unity3d/services/core/device/Device.java, line(s) 170

中危安全漏洞 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息 

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/unity3d/services/core/webview/WebView.java, line(s) 86,99

中危安全漏洞 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/unity3d/ads/core/data/datasource/AndroidDynamicDeviceInfoDataSource.java, line(s) 415,460
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 54

中危安全漏洞 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/unity3d/services/core/configuration/Configuration.java, line(s) 23

中危安全漏洞 应用程序包含隐私跟踪程序 

此应用程序有多个4隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

安全提示信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
bitter/jnibridge/a.java, line(s) 36,56
com/iab/omid/library/unity3d/publisher/b.java, line(s) 29,31
com/iab/omid/library/unity3d/utils/d.java, line(s) 18,11
com/unity3d/ads/UnityAdsBaseOptions.java, line(s) 30
com/unity3d/ads/adplayer/CommonWebViewBridge.java, line(s) 178
com/unity3d/ads/adplayer/GetAdAssetLoaderKt.java, line(s) 47
com/unity3d/ads/adplayer/GetWebViewAssetLoaderKt.java, line(s) 56
com/unity3d/ads/core/data/datasource/AndroidDynamicDeviceInfoDataSource.java, line(s) 117,154,329,572,288
com/unity3d/ads/core/data/datasource/AndroidStaticDeviceInfoDataSource.java, line(s) 190,209,230,261,303,309,450,474,490,492,512
com/unity3d/ads/core/data/repository/AndroidDiagnosticEventRepository.java, line(s) 166
com/unity3d/ads/core/domain/InitializeAndroidBoldSDK.java, line(s) 103,112
com/unity3d/ads/core/domain/LegacyLoadUseCase.java, line(s) 175,190
com/unity3d/ads/core/domain/LegacyShowUseCase$showError$1.java, line(s) 108
com/unity3d/ads/core/domain/LegacyShowUseCase.java, line(s) 96,148,155,170
com/unity3d/ads/gatewayclient/CommonGatewayClient.java, line(s) 79
com/unity3d/ads/metadata/MetaData.java, line(s) 42,57
com/unity3d/services/SDKErrorHandler.java, line(s) 97
com/unity3d/services/UnityServices.java, line(s) 88,151,158,163,171,177,186,192,183,195,126
com/unity3d/services/ads/UnityAdsImplementation.java, line(s) 118,89
com/unity3d/services/ads/adunit/AdUnitActivityController.java, line(s) 360,362,53,129,187,220,261,291,311,377,225
com/unity3d/services/ads/adunit/AdUnitViewHandlerFactory.java, line(s) 22
com/unity3d/services/ads/adunit/VideoPlayerHandler.java, line(s) 17,35
com/unity3d/services/ads/api/AdUnit.java, line(s) 203,209,258,261,265,268,325,328,331,334,361,110,132,155,163,339,352,364,368,410,494
com/unity3d/services/ads/api/VideoPlayer.java, line(s) 59,77,100,118,167,178
com/unity3d/services/ads/api/WebPlayer.java, line(s) 52
com/unity3d/services/ads/gmascar/adapters/ScarAdapterFactory.java, line(s) 42
com/unity3d/services/ads/gmascar/bridges/AdapterStatusBridge.java, line(s) 21,39
com/unity3d/services/ads/gmascar/bridges/InitializeListenerBridge.java, line(s) 21,40
com/unity3d/services/ads/gmascar/bridges/mobileads/MobileAdsBridge.java, line(s) 20
com/unity3d/services/ads/gmascar/bridges/mobileads/MobileAdsBridgeLegacy.java, line(s) 19
com/unity3d/services/ads/gmascar/finder/GMAInitializer.java, line(s) 53
com/unity3d/services/ads/gmascar/finder/ScarVersionFinder.java, line(s) 37,49
com/unity3d/services/ads/token/InMemoryAsyncTokenStorage.java, line(s) 145,179
com/unity3d/services/ads/token/NativeTokenGenerator.java, line(s) 41
com/unity3d/services/ads/topics/TopicsReceiver.java, line(s) 45
com/unity3d/services/ads/topics/TopicsService.java, line(s) 81
com/unity3d/services/ads/video/VideoPlayerView.java, line(s) 56,59,83,126,131,153,196,208,240
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 61,67,395,397,414,507,549,608,623,638,651
com/unity3d/services/banners/BannerView.java, line(s) 163
com/unity3d/services/banners/UnityBanners.java, line(s) 338
com/unity3d/services/core/api/Cache.java, line(s) 166,180,56,132,185,299,307,329
com/unity3d/services/core/api/DeviceInfo.java, line(s) 143,161,188,326,351,365,419
com/unity3d/services/core/api/Intent.java, line(s) 49,63,209,233,248
com/unity3d/services/core/api/Request.java, line(s) 33,45,96,108,126,138
com/unity3d/services/core/api/Sdk.java, line(s) 17,38,54,80,86,92,98
com/unity3d/services/core/broadcast/BroadcastEventReceiver.java, line(s) 36
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 24,26,65,69,78,103,107,113,120,29,58,73
com/unity3d/services/core/cache/CacheThread.java, line(s) 77
com/unity3d/services/core/cache/CacheThreadHandler.java, line(s) 42,45,49,72
com/unity3d/services/core/configuration/ConfigurationReader.java, line(s) 25
com/unity3d/services/core/configuration/ConfigurationRequestFactory.java, line(s) 39
com/unity3d/services/core/configuration/EnvironmentCheck.java, line(s) 28,41,31,44,47,50,53
com/unity3d/services/core/configuration/ExperimentObject.java, line(s) 24
com/unity3d/services/core/configuration/ExperimentsReader.java, line(s) 25
com/unity3d/services/core/configuration/InitializationNotificationCenter.java, line(s) 47
com/unity3d/services/core/configuration/InitializeEventsMetricSender.java, line(s) 42,52,60,70,165,172
com/unity3d/services/core/configuration/InitializeThread.java, line(s) 273,309,436,451,495,503,603,615,640,694,124,282,285,316,319,364,384,552,589,698,853,862,195,345,445,529
com/unity3d/services/core/configuration/PrivacyConfigurationLoader.java, line(s) 63
com/unity3d/services/core/connectivity/ConnectivityMonitor.java, line(s) 56,85,95,76,125
com/unity3d/services/core/device/AdvertisingId.java, line(s) 125,143,153
com/unity3d/services/core/device/Device.java, line(s) 172,498,549,558,304
com/unity3d/services/core/device/OpenAdvertisingId.java, line(s) 127,149,156
com/unity3d/services/core/device/Storage.java, line(s) 90,95,110
com/unity3d/services/core/device/reader/DeviceInfoReaderCompressor.java, line(s) 20,33
com/unity3d/services/core/device/reader/DeviceInfoReaderExtended.java, line(s) 46,52
com/unity3d/services/core/domain/task/InitializeStateConfig$doWork$2.java, line(s) 59
com/unity3d/services/core/domain/task/InitializeStateCreate$doWork$2.java, line(s) 52,58,69
com/unity3d/services/core/domain/task/InitializeStateError$doWork$2.java, line(s) 49
com/unity3d/services/core/domain/task/InitializeStateLoadCache.java, line(s) 145
com/unity3d/services/core/domain/task/InitializeStateNetworkError$doWork$2.java, line(s) 53
com/unity3d/services/core/domain/task/InitializeStateNetworkError.java, line(s) 103,120
com/unity3d/services/core/log/DeviceLog.java, line(s) 68,225,232
com/unity3d/services/core/misc/JsonFlattener.java, line(s) 43
com/unity3d/services/core/misc/JsonStorage.java, line(s) 156,26,32,51,72,84,96,165,171
com/unity3d/services/core/misc/JsonStorageAggregator.java, line(s) 34
com/unity3d/services/core/misc/Utilities.java, line(s) 40,58,178
com/unity3d/services/core/misc/ViewUtilities.java, line(s) 25,33
com/unity3d/services/core/preferences/AndroidPreferences.java, line(s) 14,26,38,50,62
com/unity3d/services/core/properties/ClientProperties.java, line(s) 40,71,83,85
com/unity3d/services/core/properties/SdkProperties.java, line(s) 246,248,105
com/unity3d/services/core/reflection/GenericBridge.java, line(s) 32,47,56,62,70,76,84,91
com/unity3d/services/core/request/WebRequest.java, line(s) 83,176,180
com/unity3d/services/core/request/WebRequestRunnable.java, line(s) 96,81,100,110
com/unity3d/services/core/request/WebRequestThread.java, line(s) 65,128,142
com/unity3d/services/core/request/metrics/MetricCommonTags.java, line(s) 73
com/unity3d/services/core/request/metrics/MetricSender$sendMetrics$$inlined$CoroutineExceptionHandler$1.java, line(s) 21
com/unity3d/services/core/request/metrics/MetricSender$sendMetrics$1.java, line(s) 79,81
com/unity3d/services/core/request/metrics/MetricSender.java, line(s) 71,84,92
com/unity3d/services/core/request/metrics/MetricSenderWithBatch.java, line(s) 42
com/unity3d/services/core/request/metrics/SDKMetrics.java, line(s) 31,45,55,79,90
com/unity3d/services/core/sensorinfo/SensorInfoListener.java, line(s) 28
com/unity3d/services/core/timer/BaseTimer.java, line(s) 81
com/unity3d/services/core/webview/WebView.java, line(s) 184
com/unity3d/services/core/webview/WebViewApp.java, line(s) 56,112,226,271,327,392,63,67,70,87,159,175,204,307,319,349,364,405,420
com/unity3d/services/core/webview/WebViewUrlBuilder.java, line(s) 25
com/unity3d/services/core/webview/bridge/Invocation.java, line(s) 79
com/unity3d/services/core/webview/bridge/NativeCallback.java, line(s) 45
com/unity3d/services/core/webview/bridge/WebViewBridge.java, line(s) 91
com/unity3d/services/core/webview/bridge/WebViewBridgeInterface.java, line(s) 45,52
com/unity3d/services/core/webview/bridge/WebViewCallback.java, line(s) 50
com/unity3d/services/store/core/StoreLifecycleListener.java, line(s) 54
com/unity3d/services/store/gpbl/bridges/CommonJsonResponseBridge.java, line(s) 39
com/unity3d/services/store/gpbl/bridges/PurchaseBridge.java, line(s) 38
org/fmod/FMODAudioDevice.java, line(s) 68
org/fmod/a.java, line(s) 76

综合安全基线评分: ( Blades of Deceron 0.1.5)