安全分析报告： Meta_Task v1.0

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/unity3d/ads/metadata/InAppPurchaseMetaData.java, line(s) 13
com/unity3d/services/ads/gmascar/utils/ScarConstants.java, line(s) 4,5,6,8,9
com/unity3d/services/core/configuration/ExperimentObject.java, line(s) 7,8
com/unity3d/services/core/device/reader/DeviceInfoReaderFilterProvider.java, line(s) 10,11
com/unity3d/services/core/device/reader/JsonStorageKeyNames.java, line(s) 4,6,7,9,10,11,8,12,5,13,14,15
com/unity3d/services/core/properties/SdkProperties.java, line(s) 27

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/chatwithme/syonife/ArticleReadActivity.java, line(s) 48
com/chatwithme/syonife/CaptchaActivity.java, line(s) 51
com/chatwithme/syonife/CountryActivity.java, line(s) 30
com/chatwithme/syonife/DebugActivity.java, line(s) 37
com/chatwithme/syonife/FaqActivity.java, line(s) 44
com/chatwithme/syonife/HistoryActivity.java, line(s) 42
com/chatwithme/syonife/HomeActivity.java, line(s) 82
com/chatwithme/syonife/LeaderboardActivity.java, line(s) 42
com/chatwithme/syonife/LoginActivity.java, line(s) 70
com/chatwithme/syonife/MainActivity.java, line(s) 37
com/chatwithme/syonife/MaintenanceActivity.java, line(s) 23
com/chatwithme/syonife/MathquizActivity.java, line(s) 55
com/chatwithme/syonife/NoInternetActivity.java, line(s) 18
com/chatwithme/syonife/NotificationsActivity.java, line(s) 46
com/chatwithme/syonife/ProfileActivity.java, line(s) 77
com/chatwithme/syonife/ReferActivity.java, line(s) 67
com/chatwithme/syonife/ReferListActivity.java, line(s) 48
com/chatwithme/syonife/ReviewYtActivity.java, line(s) 57
com/chatwithme/syonife/ScratchCardActivity.java, line(s) 55
com/chatwithme/syonife/SketchwareUtil.java, line(s) 29
com/chatwithme/syonife/SpinnerActivity.java, line(s) 58
com/chatwithme/syonife/UpdateActivity.java, line(s) 39
com/chatwithme/syonife/VideoAdsActivity.java, line(s) 54
com/chatwithme/syonife/WithdrawActivity.java, line(s) 56
com/chatwithme/syonife/WithdrawHisActivity.java, line(s) 43
com/unity3d/services/core/request/metrics/SDKMetrics.java, line(s) 9

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 89,73
com/unity3d/services/core/webview/WebView.java, line(s) 74,47

向Firebase上传文件


Files:
com/chatwithme/syonife/ProfileActivity.java, line(s) 1329,69
com/chatwithme/syonife/ReviewYtActivity.java, line(s) 552,50

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/unity3d/services/core/device/Device.java, line(s) 504

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/chatwithme/syonife/FileUtil.java, line(s) 345,679,341,349,359
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 31

此应用程序有多个2隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
"firebase_database_url" : "https://chat-with-me-syonife-default-rtdb.firebaseio.com"
"google_api_key" : "AIzaSyCW80PQJxblVwvq9W8CRIEs37DIrn88l-Y"
IjUqQV0hezRIXDAxK3JQPCcyQkos
GztmZFYhMTRDXSF0BUJWOzElWVE6OmY=
NjsiSFY0OSMNdBwfAw0HdRsUDVU6MCNBGBkdDWgYag==
IjUqQV0hezVYWgokJ1RVMDoyclUwIC5CXCY=
IjUqQV0hezZMQTgxKFlnODEyRVcxJw==
NDoiX1c8MGhEViExKFkWMCwyX1l7BxJ/fRQZ
NjsrA1k7MDRCUTF6JUxVMCYnA1k2IC9CVnsXFGJo
DDszDVs0OmZDVyF0I0NMMCZmQk87dDRIXjAmZm5XMTE=
MTUvQUEKMCdZWXogKUlZLAs1Tko0ICVFWzQmIg==
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGd0BUJROydma0o6OWZ+SDw6
NDoiX1c8MGhMSCV6B11IEjgpT1k5Jw==
HDoiSEAaITJiXhc7M0NcJhE+Tl0lIC9CVg==
FHQQSEo8Mi9OWSE9KUMYGT0oRhgdNTUNejAxKA1rMDoyDWw6dB9CTSd0A0BZPDhmblAwNy0NYTohNA1xOzYpVRgaJmZ+SDQ5ZmtXOTAjXw==
GjgiDWg0JzVaVycwZmRLdR0oTlcnJiNOTA==
FjsoSko0IDNBWSE9KUNLdXVmJ2E6IWZKVyF0
BTU1Xk86JiINajAnI1kYHTU1DXowMSgNazA6Mg1sOnQfQk0ndBRIXzwnMkhKMDBmaFU0PSoDGAU4I0xLMHQFRV02P2Z0VyAmZmBZPDhmZFY3Oz4Ndyd0FV1ZOHo=
PSAyXUtve2lZXTkxIV9ZOHorSBc4MTJMZyE1NUZnOjIgRFs8NSo=
NjsoWV07IHwCFzE7MUNUOjUiXhclISRBUTYLIkJPOzgpTFwm
BTgjTEswdANDTDAmZn9dMj01WV0nMSINfTg1L0E=
BTU1Xk86JiINcDQnZm5QNDohSFx1BzNOWzAnNUtNOTg/
BTgjTEswdAdJXHUNKVhKdQQnVFUwOjINfDAgJ0RUJnQAQko4dBZfVzM9Kkg=
PSAyXUtve2lAXSE7MkhLITk/X1cgICNEVns2KkJfJiQpWRY2OysCSHo5I1lZITU1RhU0JDYASCc9MExbLHk2QlQ8Nz8DUCE5Kg==
BiA0RFYyHShJXS0bM1l3MxYpWFYxJwNVWzAkMkRXOw==
GztmZFYhMTRDXSF0BUJWOzElWVE6OmcM
MTBrYHUYeT9UQSx0LkUCODl8Xkt1NQ==
FjUoCkx1FSJJGBoyIERbPDUqDXE7dAhMVTA=
HDowTFQ8MGZ/XTMxNA17OjAjAxgBJj8NeTI1L0MY
dQIvSV06J2ZsXCZ0YA19NCYoDX0tIDRMGBY7L0NLdQ==
Mz0qSBglNTJFGDE7NUhWIXQjVVEmIA==
GDskRFQwdAhYVTcxNA1xJnQPQ1s6JjRIWyE=
BTU1Xk86JiINdSAnMg16MHQBX100ICNfGAE8J0MYYHQFRVknNSVZXScn
BTgjTEswdAdJXHUNKVhKdQQnVFUwOjINfDAgJ0RUJnQAX1c4dBZfVzM9Kkg=
GTshSl0ndCdBSjA1IlQYJyEoQ1E7Mw==
DDszXxgUNyVCTTsgZmVZJnQESF07dARMVjsxIg18IDFmeVd1BzNeSDw3L0JNJnQHTkw8Ii9ZQQ==
NjsrA1k7MDRCUTF6I1VMMCYoTFQmIClfWTIxaElXNiErSFYhJw==
PSAyXUtve2ldVDQtaEpXOjMqSBY2OysCSyE7NEgXNCQ2XhcxMTJMUTkneURcaDcpQBYhJjVHFiU1L15Z
BSYpS1E5MWZ+XSF0FVhbNjE1Xl4gOCpU
DDszXxgxMTBEWzB0IkJdJjphWRgmITZdVycgZllQMHQlX1cldCdOTDw7KAw=
ADonW1k8OCdPVDA1Mg15IXQSRVEmdAtCVTA6Mg==
NjsrA0s+MTJOUCI1NEgWJzErQlx7FQV5cRoaGWN9AgsCaHoAExlhdxI=
FCYjDWE6IWZ+TScxZnlXdRgpSlcgIHk=
MT01TFo5MQJIWSE8CUN+PDgjeEo8ET5dVyYhNEg=
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGB0BUJROydma0o6OWZ+SDw6
HTEqQVd1GSNZWQoAJ15TdQczXUg6JjIBMl90C1QYGzUrSBgcJ2YXFXU=
JTUvXlkwNTRDUTszJ11IFTMrTFE5eiVCVQ==
NDoiX1c8MGhEViExKFkWMCwyX1l7FQphdwILC3h0AR0WYX0=
GDskRFQwdAhYVTcxNA17PTUoSl0xdBVYWzYxNV5eIDgqVA==
Aj0yRVwnNTENajAlM0hLIXQVWFo4PTJZXTE=
NDoiX1c8MGhMSCV6B05MPCIvWUEBPDRIWTE=
EDoySEp1AidBUTF0C0JaPDgjDXYgOSRISg==
BjsrSEw9PShKGAIxKFkYAiYpQ18=
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGJ0BUJROydma0o6OWZ+SDw6
IjUqQV0hezFETD0wNExPCjwvXkw6Jj8=
MTUvQUEKMCdZWXogKUlZLAsnX0w8NypI
NDoiX1c8MGhEViExKFkWNDcyRFc7ehBkfQI=
BjsrSEw9PShKGAIxKFkYAiYpQ197dBZBXTQnIw17OjoyTFshdBNe
BiApXUg8OiENVDozIUhKdTY/DU0mMTQNSjAlM0hLIXo=
ADonW1k8OCdPVDB0J1kYITwvXhg4OytIViE=
NjsrA1k7MDRCUTF6Nl9XIz0iSEomeiJCTzs4KUxcJnoiQlsgOSNDTCY=
GztmZFYhMTRDXSF0BUJWOzElWVE6Og==
OjoUSE4wNSp9XSc3I0NMFjwnQ18wMApESyExKEhKb3Q=
HDowTFQ8MGZMSjwgLkBdIT0lTFR1OzZISjQgL0JWXw==
PSAyXQJ6ezZBWSx6IUJXMjgjA1s6OWleTDomIwJZJSQ1AlwwICdEVCZrL0kFNjsrA089NTJeWSUk
DDszDXA0IiMNeTkmI0xcLHQLTFwwdAcNaDQtK0hWIXQSQlw0LQ==
GTshSl0ndCFCTHU/L0FUMDBoDWowJzJMSiE9KEoW
GDskRFQwdAhYVTcxNA11ICcyDXowdAFfXTQgI18YATwnQxhsdAJEXzwgNQ==
PSAyXUtve2lMSDx6L11RMy1oQkoye3lLVyc5J1kFPycpQw==
NDoiX1c8MGhEViExKFkWMCwyX1l7AAN1bA==
ASYnQ0s5ISVIViEXKUNOMCY1RFc7GC9eTDA6I18=
MzsoWUt6OzZIViY1KF5nNzsqSRYhICA=
DDszXxgAJyNfdjQ5Iw1QNCdmTlA0OiFIXHUnM05bMCc1S005OD8=
GzUrSBgYITVZGBcxZmpKMDUySEp1AC5MVnVgZmxWMXQKSEsmdBJFWTt0dxgYFjwnX1k2ICNfSw==
BjEoWRgTOzQNbjAmL0tRNjUyRFc7emZ9VDA1NUgYAjUvWRgTOzQNbjAmL0tRNjUyRFc7
HDowTFQ8MGZeTCc9KEoYOiQjX1khPSlDMg==
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGZ0BUJROydma0o6OWZ+SDw6
NDoiX1c8MGhdXSc5L15LPDsoA28HHRJoZxAMEmhqGxUKcmsBGxRsfxA=
FjUoCkx1EykNejQ3LQ18ICYvQ191BzZEVg==
dTwnXhgcOjBETDAwZnRXIHQSQhgROzFDVDo1Ig1oND01TBgQNTRDUTszZmxIJXQAX1c4dAFCVzI4Iw1oOTU/DWshOzRIFl9eTHhLMHQLVBgHMSBISnUXKUlddXlm
Dgg2VnE7FylAWjw6L0NfET0nTko8IC9OWTkZJ19TJikb
DDszXxgbMTENaDQtK0hWIXQCSEw0PSoNcDQnZm5QNDohSFx1BzNOWzAnNUtNOTg/
ETEwRFswGidAXXU5M15MdTYjDVE7PTJEWTk9PEhcdTYjS1cnMWZYSzQzIwM=
dRcpRFYmekx9VDA1NUgYAz01REx1FSFMUTt0EkJVOiY0Qk8=
HDowTFQ8MGZZVxshK09dJ3QkQVc2P2ZCSDAmJ1lROjpM
ECY0Qkp1NzRIWSE9KEoYNDoiX1c8MGtJXSM9JUhLezAkDVw0ICdPWSYx
EDoySEp1DSlYSnUEJ1RVMDoyDVwwICdEVCZ0bkFRPjFmFxUwOSdEVHp0M11RdT0iAhg4OzRIFnt6bw==
MTUvQUEKMCdZWXoiL0ldOgsnSUsKICdeUyY=
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGx0BUJROydma0o6OWZ+SDw6
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGF0BUJROydma0o6OWZ+SDw6
HDoySEomIC9ZUTQ4GWxWMSYpRFw=
MzsoWUt6JidBXSI1P3JKMDMzQVknejJZXg==
BjsrSEw9PShKGCIxKFkYIiYpQ191pNm1pg==
NjsrA0s+MTJOUHsnMkJKMHojTEo7PShKFjQkNg==
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGR0BUJROydma0o6OWZ+SDw6
FjwjTlN1HShZXSc6I1kYFjsoQ102IC9CVg==
dTcpRFYmdCBCSnUxJ05QdTcnXUw2PCcNXjw4KgM=
ATwvXhgRMTBEWzB0D14YFDg0SFkxLWZ/XTI9NVldJzEiAw==
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGN0BUJROydma0o6OWZ+SDw6
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGGRkZm5XPDo1DX4nOysNayU9KA==
NDoiX1c8MGhdXSc5L15LPDsoA2oQFQJyfQ0AA392FBgZfmwaBgdqfQ==
X14HQ1x1EyNZGBMmI0gYFjsvQ0t7dA5ISjB0D14YETsxQ1Q6NSINdDw6LQ0y
GztmZFYhMTRDXSF0BUJWOzElWVE6OmgNbCctZmxfND0o
NjsrA1k7MDRCUTF6Nl9XIz0iSEomeitIXDw1aElXNiErSFYhJw==
OjoHSXE7ICNfSyE9MkRZORcpQEg5MTJI
FjsoSko0IDNBWSE9KUNLdF4fQk11MylZGG10BUJROydma0o6OWZ+SDw6
HDowTFQ8MGZEViExKFkYOiQjX1khPSlD
dRcpRFYmemZuVzk4I05MdQ0pWEp1BiNaWScwZmNXIg==
MTBmYHUYdD9UQSx0LkUCODl8Xkt1NQ==
FCYjDWE6IWZ+TScxZnlXdRE+REx1AC5IGBQkNg0H
BTgjTEswdBBISjwyPw1hOiE0DX04NS9BGBcxIEJKMHQKQl88Og==
NDoiX1c8MGhEViExKFkWNDcyRFc7egFobAoXCWNsEBoS
BTgjTEswdBFMUSF0EExKPDIvQ197emg=
HDowTFQ8MGZBUSYgZkJIMCYnWVE6Okw=