Closed Chanick-Park closed 10 months ago
Hello @Chanick-Park, thank you for the information, we have task about that in our backlog already, we will inform you about ETAs later.
Hello @Chanick-Park it was fixed in the version 12.1.0
@riskpp Sounds great! Thank you.
Hi Team,
We received a report about a security problem with the cryptographic algorithms of the app currently in service. Please see the details below and avoid the weak cryptographic algorithms to protect information and processes Thank you,
Finding Description
The application was found to operate weak cryptographic algorithms on sensitive data while exercising the app. These outdated algorithms are often in violation of common compliance standards and can be vulnerable to publicly-disclosed and non-public attacks. The sensitive data being encoded with the weak algorithm is also at a greater risk of being exposed due to the often trivial effort to decode the data.
Steps to Reproduce
Source code should be inspected for uses of weak cryptographic algorithms. These inspections may also reveal the use of weak cryptography by third party code. Please avoid the following weak cryptographic algorithms: RC4, DES, DES3, MD5, SHA1, MD4, ECB, & CBC. NowSecure's automated testing for this vulnerability analyzes CommonCrypto API requests that use easily decrypted algorithms and then attempts to decode or decrypt sensitive data.
Business Impact
Weak cryptographic algorithms have well documented vulnerabilities that can cause issues relating to loss of confidentiality or an inability to maintain the integrity of business sensitive processes. The use of outdated cryptography may also affect an organization's regulatory and compliance certifications.
Remediation Resources
Recommended Fix Do not use weak cryptographic algorithms to protect information and processes such as RC4, DES, DES3, MD5, SHA1, MD4, ECB, & CBC as well as algorithms discussed here. For guidance on best practices in picking strong cryptography, please see OWASP's Cryptographic Storage Cheat_Sheet. Details and code snippets can be found at https://developer.apple.com/documentation/uikit/protecting_the_user_s_privacy/encrypting_your_app_s_files. The Findings Evidence table provides the instances where an insecure method was used paired with the data that was encrypted.
Code Samples Good Code Example (.swift)
Good Code Example (.objc)
Additional Guidance This link provides a general overview of cryptography concepts: https://developer.apple.com/library/archive/documentation/Security/Conceptual/cryptoservices/CryptographyConcepts/CryptographyConcepts.html This resources describes asymmetric and symmetric keys for cryptography: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/using_keys_for_encryption Risk and Regulatory Information Severity: medium CVSS: 4.8
CWE: 312 FISMA MED: SC-28 PROTECTION OF INFORMATION AT REST Risk OWASP: Mobile Top 10: M2-Insecure Data Storage, MASVS 3.2 GDPR: Risks violating Article 25, Risks violating Article 32 FFIEC: May violate D3.PC.Am.A.1 PCI: May violate requirement 3.1 through 3.4 HIPAA: May violate §164.312(a)(1): Standard: Access control. CCPA: Risks violating CCPA: exfiltration, theft, or disclosure of PII CWE Top 25: 2021 CWE Top 25 Most Dangerous Software Errors