安全分析报告： VIP NOBITA FF v1.7

安全分数


安全分数 41/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

1

用户/设备跟踪器


调研结果

高危 2
中危 10
信息 1
安全 0
关注 2

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/unity3d/services/core/webview/WebViewApp.java, line(s) 285,10,320,346,352,358

高危 WebView域控制不严格漏洞 

WebView域控制不严格漏洞


Files:
com/unity3d/services/core/webview/WebView.java, line(s) 23,18

中危 应用程序存在Janus漏洞 

应用程序使用了v1签名方案进行签名，如果只使用v1签名方案，那么它就容易受到安卓5.0-8.0上的Janus漏洞的攻击。在安卓5.0-7.0上运行的使用了v1签名方案的应用程序，以及同时使用了v2/v3签名方案的应用程序也同样存在漏洞。

中危 应用程序可以安装在有漏洞的已更新 Android 版本上 

Android 5.0-5.0.2, [minSdk=21]
该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据可以被备份 

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 29
com/vip/nobita/ff/FileUtil.java, line(s) 328,659,324,332,342

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/unity3d/services/core/device/Device.java, line(s) 442

中危 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 88,72
com/unity3d/services/core/webview/WebView.java, line(s) 71,47

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/unity3d/ads/metadata/InAppPurchaseMetaData.java, line(s) 12

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/unity3d/services/core/request/SDKMetrics.java, line(s) 9
com/vip/nobita/ff/CrossActivity.java, line(s) 12
com/vip/nobita/ff/MainActivity.java, line(s) 70
com/vip/nobita/ff/SketchwareUtil.java, line(s) 27

中危 应用程序包含隐私跟踪程序 

此应用程序有多个1隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
com/unity3d/ads/UnityAds.java, line(s) 240,242
com/unity3d/ads/UnityAdsBaseOptions.java, line(s) 17
com/unity3d/ads/metadata/InAppPurchaseMetaData.java, line(s) 61,76,80
com/unity3d/ads/metadata/MetaData.java, line(s) 72,81
com/unity3d/services/UnityServices.java, line(s) 27,65,71,77,88,105,97,99,113,42
com/unity3d/services/ads/UnityAdsImplementation.java, line(s) 43,181
com/unity3d/services/ads/adunit/AdUnitActivity.java, line(s) 429,431,51,114,136,158,181,219,350,395,455,186
com/unity3d/services/ads/adunit/VideoPlayerHandler.java, line(s) 32,50
com/unity3d/services/ads/api/AdUnit.java, line(s) 75,78,81,84,107,417,423,475,479,484,488,98,111,116,121,153,243,331,347,376,383
com/unity3d/services/ads/api/VideoPlayer.java, line(s) 56,74,92,110,128,164
com/unity3d/services/ads/api/WebPlayer.java, line(s) 132
com/unity3d/services/ads/configuration/AdsModuleConfiguration.java, line(s) 51,62,70
com/unity3d/services/ads/load/LoadBridge.java, line(s) 25
com/unity3d/services/ads/video/VideoPlayerView.java, line(s) 46,78,93,136,142,195,206,233
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 63,164,201,205,298,310,321,333,354,416
com/unity3d/services/ar/ARUtils.java, line(s) 67,87,106
com/unity3d/services/ar/view/ARView.java, line(s) 194,272,97,113,237,324,329,337,354
com/unity3d/services/ar/view/GLSurfaceView.java, line(s) 268,282,454,1038,531,723
com/unity3d/services/ar/view/ShaderLoader.java, line(s) 13,27
com/unity3d/services/banners/BannerView.java, line(s) 108
com/unity3d/services/banners/UnityBanners.java, line(s) 140
com/unity3d/services/core/api/Cache.java, line(s) 178,192,42,114,131,158,197,207
com/unity3d/services/core/api/DeviceInfo.java, line(s) 223,242,256,307,315,343,517
com/unity3d/services/core/api/Intent.java, line(s) 86,102,125,162,176
com/unity3d/services/core/api/Request.java, line(s) 32,44,62,74,91,103
com/unity3d/services/core/api/Sdk.java, line(s) 14,38,83,95,65,77,71
com/unity3d/services/core/broadcast/BroadcastEventReceiver.java, line(s) 35
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 40,44,51,89,92,97,101,110,112,33,54,115
com/unity3d/services/core/cache/CacheThread.java, line(s) 28
com/unity3d/services/core/cache/CacheThreadHandler.java, line(s) 47,144,147,151,624,627,631,254,331,343,364,388,409,433,454,478,499,523,544,568,589
com/unity3d/services/core/configuration/Configuration.java, line(s) 191
com/unity3d/services/core/configuration/EnvironmentCheck.java, line(s) 20,39,23,26,29,32,42
com/unity3d/services/core/configuration/InitializationNotificationCenter.java, line(s) 65
com/unity3d/services/core/configuration/InitializeThread.java, line(s) 124,137,163,311,326,407,511,523,543,41,50,380,415,418,458,497,547,610,703,274,318,354,681
com/unity3d/services/core/connectivity/ConnectivityMonitor.java, line(s) 111,127,153,100,145
com/unity3d/services/core/device/AdvertisingId.java, line(s) 176,48,58
com/unity3d/services/core/device/Device.java, line(s) 71,301,306,316,325,354,370,379,444,551,561,574,107
com/unity3d/services/core/device/OpenAdvertisingId.java, line(s) 167,56,63
com/unity3d/services/core/device/Storage.java, line(s) 35,39,69
com/unity3d/services/core/log/DeviceLog.java, line(s) 173,213,220
com/unity3d/services/core/misc/JsonStorage.java, line(s) 59,53,62,70,82,118,138,156,162
com/unity3d/services/core/misc/Utilities.java, line(s) 135,45,66,105,111,116,129
com/unity3d/services/core/misc/ViewUtilities.java, line(s) 17,26
com/unity3d/services/core/preferences/AndroidPreferences.java, line(s) 18,30,42,54,66
com/unity3d/services/core/properties/ClientProperties.java, line(s) 67,84,96,98
com/unity3d/services/core/properties/SdkProperties.java, line(s) 197,199
com/unity3d/services/core/request/SDKMetrics.java, line(s) 19,30,44,73,75,77,92,95,97
com/unity3d/services/core/request/WebRequest.java, line(s) 263,151,157,166
com/unity3d/services/core/request/WebRequestRunnable.java, line(s) 34,38,81
com/unity3d/services/core/request/WebRequestThread.java, line(s) 43,149,163
com/unity3d/services/core/sensorinfo/SensorInfoListener.java, line(s) 50
com/unity3d/services/core/webview/WebView.java, line(s) 80,28,106,110
com/unity3d/services/core/webview/WebViewApp.java, line(s) 130,136,157,186,348,353,389,149,179,220,261,276,283,288,333,361,364,367,382
com/unity3d/services/core/webview/bridge/Invocation.java, line(s) 48
com/unity3d/services/core/webview/bridge/NativeCallback.java, line(s) 39
com/unity3d/services/core/webview/bridge/WebViewBridge.java, line(s) 98
com/unity3d/services/core/webview/bridge/WebViewBridgeInterface.java, line(s) 10,26
com/unity3d/services/core/webview/bridge/WebViewCallback.java, line(s) 55
com/unity3d/services/monetization/UnityMonetization.java, line(s) 45
com/unity3d/services/monetization/core/utilities/JSONUtilities.java, line(s) 23,35,54
com/unity3d/services/monetization/placementcontent/core/PlacementContent.java, line(s) 49,62
com/unity3d/services/purchasing/core/TransactionDetailsUtilities.java, line(s) 26
com/unity3d/services/purchasing/core/TransactionErrorDetailsUtilities.java, line(s) 22
com/unity3d/services/purchasing/core/api/CustomPurchasing.java, line(s) 59
com/unity3d/services/store/StoreBilling.java, line(s) 59,23,26,30,34

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (config.unityads.unitychina.cn) 通信。 

{'ip': '58.216.88.121', 'country_short': 'CN', 'country_long': 'China', 'region': 'Jiangsu', 'city': 'Changzhou', 'latitude': '31.783331', 'longitude': '119.966667'}

关注 应用程序可能与位于OFAC制裁国家 (Hong Kong) 的服务器 (config.unityads.unity3d.com) 通信。 

{'ip': '13.224.167.60', 'country_short': 'HK', 'country_long': 'Hong Kong', 'region': 'Hong Kong', 'city': 'Hong Kong', 'latitude': '22.285521', 'longitude': '114.157692'}

安全评分: ( VIP NOBITA FF 1.7)