search

varengold / activeTAN-Android

Source code for the Android activeTAN application
GNU General Public License v3.0
6 stars 3 forks source link

Cryptographic APIs misuses #1

Open misterAnderson90 opened 2 years ago

misterAnderson90 commented 2 years ago

I'm a PhD student interested in finding security vulnerabilities in open source projects.

We found a total of 25 warnings (indicating potential vulnerabilities) when running the CogniCrypt static analyzer (*) on activeTAN-Android (or its library dependencies). We documented each one of these issues in private gists for the sake of confidentiality (non-disclosure).

Can you please let us know whether we can share these gists with you? We are eager to evaluate the perception of developers (e.g. severity of these warnings) and improve activeTAN-Android's security, and the quality of the reports of static analysis tools. (*) https://github.com/CROSSINGTUD/CryptoAnalysis

oheim commented 2 years ago

Hi Luis,

I can easily reproduce the warnings with your tool. You may share your findings here, so I can review and comment each of them. Please use a debug apk of activeTAN-Android, so there are no obfuscated package and class names.

Best Oliver

misterAnderson90 commented 2 years ago

Dear Oliver,

Thanks for your suggestion of running the analysis on the debug version. From the 25 warnings that CogniCrypt reported, we randomly selected 5 gists to share with you. If you are interested, we can share the report with all warnings. 

Gist 01 - Cipher Gist 02 - Cipher Gist 03 - Mac Gist 04 - KeyStore Gist 05 - KeyStore

For any doubts, you can comment directly in the gists and we can clarify the issues.  

Best regards,

oheim commented 2 years ago

Dear Luis,

the findings 1, 2, 4, and 5 are false positives and finding 3 is not a vulnerability.

I have commented in your gists.

Please share more findings, unless they are duplicates of the above.

Best Oliver