| 38 | # ------------------------------------------------------------------ |
| 39 | |
| 40 | def check_crypto(self) -> list: |
| 41 | checks = [ |
| 42 | { |
| 43 | "id": "CRYPTO_ECB_MODE", |
| 44 | "title": "ECB Mode Encryption", |
| 45 | "severity": "CRITICAL", |
| 46 | "owasp": "M10: Insufficient Cryptography", |
| 47 | "description": ( |
| 48 | "ECB (Electronic Codebook) mode encrypts identical plaintext blocks " |
| 49 | "to identical ciphertext, leaking data patterns. Attackers can " |
| 50 | "detect and manipulate encrypted data without the key." |
| 51 | ), |
| 52 | "pattern": r'Cipher\.getInstance\s*\(.*ECB', |
| 53 | }, |
| 54 | { |
| 55 | "id": "CRYPTO_HARDCODED_KEY", |
| 56 | "title": "Hardcoded Cryptographic Key", |
| 57 | "severity": "CRITICAL", |
| 58 | "owasp": "M1: Improper Credential Usage", |
| 59 | "description": ( |
| 60 | "A cryptographic key is hardcoded as a string literal in " |
| 61 | "SecretKeySpec. Any attacker who decompiles the APK can extract " |
| 62 | "the key and decrypt all protected data." |
| 63 | ), |
| 64 | "pattern": r'new\s+SecretKeySpec\s*\(\s*["\']', |
| 65 | }, |
| 66 | { |
| 67 | "id": "CRYPTO_WEAK_MD5", |
| 68 | "title": "Weak Hash Algorithm: MD5", |
| 69 | "severity": "HIGH", |
| 70 | "owasp": "M10: Insufficient Cryptography", |
| 71 | "description": ( |
| 72 | "MD5 is cryptographically broken and unsuitable for security " |
| 73 | "purposes. Collisions can be computed in seconds. Do not use " |
| 74 | "for password hashing, integrity checks, or digital signatures." |
| 75 | ), |
| 76 | "pattern": r'MessageDigest\.getInstance\s*\(\s*["\']MD5["\']', |
| 77 | }, |
| 78 | { |
| 79 | "id": "CRYPTO_INSECURE_RANDOM", |
| 80 | "title": "Insecure Random Number Generator", |
| 81 | "severity": "HIGH", |
| 82 | "owasp": "M10: Insufficient Cryptography", |
| 83 | "description": ( |
| 84 | "java.util.Random and Math.random() are not cryptographically " |
| 85 | "secure. Outputs are predictable. Use SecureRandom for any " |
| 86 | "security-sensitive value (tokens, keys, nonces, salts)." |
| 87 | ), |
| 88 | "pattern": r'new\s+Random\s*\(|Math\.random\s*\(', |
| 89 | }, |
| 90 | { |
| 91 | "id": "CRYPTO_WEAK_ALG", |
| 92 | "title": "Weak Cipher Algorithm", |
| 93 | "severity": "HIGH", |
| 94 | "owasp": "M10: Insufficient Cryptography", |
| 95 | "description": ( |
| 96 | "DES, 3DES, RC2, RC4, and Blowfish are considered weak or broken. " |
| 97 | "Use AES-256-GCM or ChaCha20-Poly1305 instead." |