NowSecure dynamic analysis: Weak Cryptographic Encryption Modes

Finding Description

The application was found to use weak cryptographic encryption modes during app runtime. These encryption modes are usually easily reverse engineered, so the data may be compromised by an observer. An attacker with access to the encrypted data may be able to determine that the data that was obfuscated.

Evaluation Criteria

It is a best practice not to use insecure methods or modes for encrypting data. However, not all companies require this. The context table below should be evaulated against the standards for the app. Also, please note there is a separate finding specifically for sensitive data being encrypted using these methods.

Steps to Reproduce

While the app is running on a physical device, CommonCrypto API requests are examined and insecure or unsuitable encryption modes are flagged.

Remediation Resources

Change to using encryption modes that are secure. Guidance can be found for Android and from Apple.

For more guidance on best practices in picking strong cryptography, please see OWASP's Cryptographic Storage Cheat Sheet.

Risk and Regulatory Information

Severity: low CVSS: 3.7

CWE: 312
ioXt: VS3
FISMA MED: SC-28 PROTECTION OF INFORMATION AT REST
Risk OWASP: Mobile Top 10: M2-Insecure Data Storage
GDPR: Risks violating Article 25, Risks violating Article 32
FFIEC: May violate D3.PC.Am.A.1
PCI: May violate requirement 3.1 through 3.4
HIPAA: May violate §164.312(a)(1): Standard: Access control.
CCPA: Risks violating CCPA: exfiltration, theft, or disclosure of PII
CWE Top 25: 2020 CWE Top 25 Most Dangerous Software Errors

Application

Platform: ios
Package: com.nowsecure.PasscodeObjcWeakCrypto

See more detail in the NowSecure Report

lcimeni / youtube