安全分析报告： rasmlar (5 dona) v31.8.955.76

安全分数


安全分数 60/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

0

用户/设备跟踪器


调研结果

高危 0
中危 12
信息 1
安全 2
关注 0

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据存在被泄露的风险 

未设置[android:allowBackup]标志
这个标志 [android:allowBackup]应该设置为false。默认情况下它被设置为true，允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 Service (uz.ltgsgywa.ojkuebiq.Service) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Broadcast Receiver (uz.ltgsgywa.ojkuebiq.Receiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.BROADCAST_SMS [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Activity-Alias (uz.ltgsgywa.ojkuebiq.CatInWonderland) 未被保护。 

[android:exported=true]
发现 Activity-Alias与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (androidx.work.impl.background.systemjob.SystemJobService) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 高优先级的Intent （1000） - {1} 个命中 

[android:priority]
通过设置一个比另一个Intent更高的优先级，应用程序有效地覆盖了其他请求。

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
nnnnnnnnnn33nnn3n333nn3333n3n333n333nnn3333n3nn3n3nnn33nnnnnnnn33n3333n333n333n3nn33/tt33ttt33t3ttt33t333tt3t3t3ttttt3333333ttt3333t333t33t3t3t33t3ttt3t33333tt33ttt33t33t33t33t.java, line(s) 3
oo0o0oo00oo000ooo00ooo/bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb.java, line(s) 10
tt4ttt44tttt44t4tt4t4t4ttt4t444tt4t4tt44tttt4t4tttt44ttt4tttt4tt44tt4t444t4444tt44tt44tt/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 3
tt4ttt44tttt44t4tt4t4t4ttt4t444tt4t4tt44tttt4t4tttt44ttt4tttt4tt44tt4t444t4444tt44tt44tt/lll6l66l6lll66lll6ll6llll6lll666ll666l6l6666ll66llll6666l6l6l6l66l66lllll6l66l666l666ll6.java, line(s) 5
tt4ttt44tttt44t4tt4t4t4ttt4t444tt4t4tt44tttt4t4tttt44ttt4tttt4tt44tt4t444t4444tt44tt44tt/tt33ttt33t3ttt33t333tt3t3t3ttttt3333333ttt3333t333t33t3t3t33t3ttt3t33333tt33ttt33t33t33t33t.java, line(s) 3

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1/vvvvvvvvvvvvvvv55vv5vvvvv5v5vv555555555555v55v5vv55vvv5v5555vv55vvvvv55v5v555vv5v555vvv5555v55vv5v5.java, line(s) 129

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
y2yyy2yy222yyyy2222y2yy2222yy2y22yyyyy/bb999bb9b9bbbb9bbb999999bbb9999bbb9b99b9bbb9bb9b999bb9b9b9bbb9b99b9b9bbb9b9b99.java, line(s) 5,25,41,42,54,55
zzzzzz11zzz111111zz11zzz11zz1111z11111zz11z111z111111zz11zzz1111zz1z1z1z111zzzzzz111z11/lll6l66l6lll66lll6ll6llll6lll666ll666l6l6666ll66llll6666l6l6l6l66l66lllll6l66l666l666ll6.java, line(s) 4,35

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
a888a888888aaaaaa8888aaaa8a8aaaa8aaa88a88aaaaaa88a8a8a8a8888a8888a8a8a888aaaa888aaaa8a8a88aa88a8a8a/tt33ttt33t3ttt33t333tt3t3t3ttttt3333333ttt3333t333t33t3t3t33t3ttt3t33333tt33ttt33t33t33t33t.java, line(s) 33
b2bbb22b2b22bb2b/oo0o0oo00oo000ooo00ooo.java, line(s) 106,133
bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb/gg99gg9999ggg99g99gggg99gg999gg9g99ggg9g9g9g9gg99gg9999gg9g999g9gggg999g9ggggg999g999gg9999gg.java, line(s) 813,1333,1743,1749,1750,1751,1760,1816,1822,1823,1824,1833,1884,376,961,1418,1425,1675
bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 71,80
bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb/jjjj11j1jjjj11jjj11jjj11j111j1jj.java, line(s) 658
bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb/nnnnn777777n7n77777nnnnnn77nnn7nnn77n77nnn777n7nnnnnnnnn7n7777nn7nn7nn.java, line(s) 51
bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb/ssss0s00ss0s0s00000ss0s00s00s0.java, line(s) 366,435
d44444dddd44dd444d4dd4d44d44d4ddddd444dd4444dd44d444d44444444d/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 38
d44d4d44d44d444444d444dd4d/oo0o0oo00oo000ooo00ooo.java, line(s) 449
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/c1ccc1c1c11111c1ccc1111111c1cc1c1ccc.java, line(s) 34,65,82,137,195,215,242
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/e8ee88eee88888888e8ee88ee8eeee88ee888e.java, line(s) 64,90,81
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/k0k0kk0k0kk0k0000k00k0kkk00k0000kkkk0k0k00kk000k0kk0k0k.java, line(s) 114
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/kkk4kk44kk4k4k4kkkkk4kk44kkkkkk4k4k44kk44kkk.java, line(s) 32,44,51,60
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/lll6l66l6lll66lll6ll6llll6lll666ll666l6l6666ll66llll6666l6l6l6l66l66lllll6l66l666l666ll6.java, line(s) 56
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/ss8sss8888888ssss88sss8s8s8s888s88ss8ssssss8ss8sss8s.java, line(s) 35,97,34
d4dd4d4ddd4444d44ddddd4444d4ddddd4444d4444dd4d4/y2yyy2yy222yyyy2222y2yy2222yy2y22yyyyy.java, line(s) 31
dddddd0d0d0000ddd000d0ddd00dd000d0dd0000d0d0d0d0d00000dd0d0d0ddd0d00dddddddd0d00ddddddddd0d0d/pp55p5p5555p5p55ppp55p55pp5pp5p5p555p5pp5555pppppp5555ppp5p5pp555pp55p5p5ppp5pp5p5p5p5p5pp5pp555ppp.java, line(s) 115,127,137,191
dddddd0d0d0000ddd000d0ddd00dd000d0dd0000d0d0d0d0d00000dd0d0d0ddd0d00dddddddd0d00ddddddddd0d0d/ssss0s00ss0s0s00000ss0s00s00s0.java, line(s) 192
ff11ff11f11ff111ff1f1ff11f111111f1f1f11f1fff1f1111f1ff1111f1ff1ff1f11f111f111f11ff11f111f11f1/dddddd0d0d0000ddd000d0ddd00dd000d0dd0000d0d0d0d0d00000dd0d0d0ddd0d00dddddddd0d00ddddddddd0d0d.java, line(s) 291
ff11ff11f11ff111ff1f1ff11f111111f1f1f11f1fff1f1111f1ff1111f1ff1ff1f11f111f111f11ff11f111f11f1/jjjj11j1jjjj11jjj11jjj11j111j1jj.java, line(s) 156,186,159
ff1ffff1fff11ff1f1ff11fff11ff111f1ffff1ffffff1ff1111111fff111f1f1fff1/lll6l66l6lll66lll6ll6llll6lll666ll666l6l6666ll66llll6666l6l6l6l66l66lllll6l66l666l666ll6.java, line(s) 64
ggg99999gg99g9gg9gggg9gg9ggggg9gg99gggggggg99gg999g99g9g9g99g9gg9g/c1ccc1c1c11111c1ccc1111111c1cc1c1ccc.java, line(s) 423,662,4384,5731
i6i6iii6i666i6i666ii666ii6666ii6iiii6ii66iii666666ii6i6i6i6iiiii6i6i666iiiiiii66ii6iiiiiiii/ssss0s00ss0s0s00000ss0s00s00s0.java, line(s) 22
iiii4i4i4444i44i4iiiiiiiiii44444i4ii4iii4ii44i4i4ii4i44i4i/bb999bb9b9bbbb9bbb999999bbb9999bbb9b99b9bbb9bb9b999bb9b9b9bbb9b99b9b9bbb9b9b99.java, line(s) 45
iiii4i4i4444i44i4iiiiiiiiii44444i4ii4iii4ii44i4i4ii4i44i4i/nnnnn777777n7n77777nnnnnn77nnn7nnn77n77nnn777n7nnnnnnnnn7n7777nn7nn7nn.java, line(s) 443,448
iiii4i4i4444i44i4iiiiiiiiii44444i4ii4iii4ii44i4i4ii4i44i4i/pp55p5p5555p5p55ppp55p55pp5pp5p5p555p5pp5555pppppp5555ppp5p5pp555pp55p5p5ppp5pp5p5p5p5p5pp5pp555ppp.java, line(s) 55,104
jj8jjjj8jj8j88jj8j8j888j88jj8888888jj8j8j8j8j8jjj888jjjj/x11xxx111x11xxxx.java, line(s) 98,186
jj8jjjj8jj8j88jj8j8j888j88jj8888888jj8j8j8j8j8jjj888jjjj/z7z77z77zzzz7z77z7.java, line(s) 265
jj8jjjj8jj8j88jj8j8j888j88jj8888888jj8j8j8j8j8jjj888jjjj/zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1.java, line(s) 47
jj8jjjj8jj8j88jj8j8j888j88jj8888888jj8j8j8j8j8jjj888jjjj/zzzzzz11zzz111111zz11zzz11zz1111z11111zz11z111z111111zz11zzz1111zz1z1z1z111zzzzzz111z11.java, line(s) 102
nn2n222n2nn22n222n2n2nn2n2n2n222n2nn2n2nn2222nnnn22n22n22nn2n2222nn2222nnn22nnn2n222nnn2nnnn2n/jjjj11j1jjjj11jjj11jjj11j111j1jj.java, line(s) 40
nnnn99n9nn9n9n999n9n999n9n99nnn99999nnn9nn9nn9n999nn99nnnn9/tt33ttt33t3ttt33t333tt3t3t3ttttt3333333ttt3333t333t33t3t3t33t3ttt3t33333tt33ttt33t33t33t33t.java, line(s) 2616,3875
o2ooo2222oo2222o222222oo22222o2oo22oo22o2o2o2222222o2o2ooo22o2oo22o2ooo2ooooooo22o222o22o222oo2/bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb.java, line(s) 17,16
oo0o0oo00oo000ooo00ooo/bbbbbb6bbb6b6b66b6b66bb66b6666bbb66b6bbb666bb.java, line(s) 55
oo0o0oo00oo000ooo00ooo/d44d4d44d44d444444d444dd4d.java, line(s) 210
oo0o0oo00oo000ooo00ooo/ff6f666ff6f6f66f6fff6f6ff6f66f6666f666f6f6ff666fffffff6666fffff66f6666ff6ff6666f6f66.java, line(s) 41
oo0o0oo00oo000ooo00ooo/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 48,251
oo0o0oo00oo000ooo00ooo/lll8ll8ll8l8l88l88l88lll88l88l88ll8l88ll8888ll8l8.java, line(s) 656,664,973,975,978,444,447,617
oo0o0oo00oo000ooo00ooo/z7z77z77zzzz7z77z7.java, line(s) 346,80,86,92
q5qqqq555555qq55q5555qqqq55qqqqqq5555q55q55qq5q5qq55qq5qq5555q5q5555qq5q555qq5q55q5qqq55qq5555/oo0o0oo00oo000ooo00ooo.java, line(s) 459
uz/ltgsgywa/ojkuebiq/Service.java, line(s) 686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814
v77vv777vv77v777vv7vv77v77vvvvv77v/tt33ttt33t3ttt33t333tt3t3t3ttttt3333333ttt3333t333t33t3t3t33t3ttt3t33333tt33ttt33t33t33t33t.java, line(s) 77
vvv5v5vvv55v555/bb999bb9b9bbbb9bbb999999bbb9999bbb9b99b9bbb9bb9b999bb9b9b9bbb9b99b9b9bbb9b9b99.java, line(s) 185,306
w88w8ww88w8ww8ww88w88www8ww888ww88w8w88888ww88ww88ww8www8w888www88wwww88ww8w8w8888www8888w88w88ww8w/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 17,38
x888xx8888x8x8xxxx8xx88x8xx8xxxx8888x8/h333h3h3333hhhh3h333h33hhhhh3hhh3h3hhhhhhhh3h3hhhhhh3h33h3h3h33h33hhh33hhh33h3hhh33h3h3hh.java, line(s) 36
y6y666666666y666yyy6666666666y66y6y66/gg99gg9999ggg99g99gggg99gg999gg9g99ggg9g9g9g9gg99gg9999gg9g999g9gggg999g9ggggg999g999gg9999gg.java, line(s) 70,72,40,42,60,62,50,52
y6y666666666y666yyy6666666666y66y6y66/nnnnn777777n7n77777nnnnnn77nnn7nnn77n77nnn777n7nnnnnnnnn7n7777nn7nn7nn.java, line(s) 55,60,69,75,81,90,97
zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1/dddddd0d0d0000ddd000d0ddd00dd000d0dd0000d0d0d0d0d00000dd0d0d0ddd0d00dddddddd0d00ddddddddd0d0d.java, line(s) 118,172
zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1/k6k666kk6kk6k666k6k66k6kkkk6kk666kkkkk6666kkk6k66kkk6kkk6kkk66k6k6k66kkk6.java, line(s) 71,83
zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1/ttt9tt999t9t9t9t9tt9t9999tt999tt9tt99tt9t9999tt9t99t99t9t9999t9t99999t9t99ttt9tt999ttt9tt.java, line(s) 65
zzzz11zz1zz111zz1z111z1zzz1z1zzz11z111zzzz11zz11zz111z1zz1zzz1/vvvvvvvvvvvvvvv55vv5vvvvv5v5vv555555555555v55v5vv55vvv5v5555vv55vvvvv55v5v555vv5v555vvv5555v55vv5v5.java, line(s) 86,89,94

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
xxx11111x1xx111xx1x111xxx1xx11x11xx11x11x1/dddddd0d0d0000ddd000d0ddd00dd000d0dd0000d0d0d0d0d00000dd0d0d0ddd0d00dddddddd0d00ddddddddd0d0d.java, line(s) 46,45,89,56,44,44
xxx11111x1xx111xx1x111xxx1xx11x11xx11x11x1/k6k666kk6kk6k666k6k66k6kkkk6kk666kkkkk6666kkk6k66kkk6kkk6kkk66k6k6k66kkk6.java, line(s) 38,37,36,36
xxx11111x1xx111xx1x111xxx1xx11x11xx11x11x1/oo0o0oo00oo000ooo00ooo.java, line(s) 39,38,37
xxx11111x1xx111xx1x111xxx1xx11x11xx11x11x1/ttt9tt999t9t9t9t9tt9t9999tt999tt9tt99tt9t9999tt9t99t99t9t9999t9t99999t9t99ttt9tt999ttt9tt.java, line(s) 42,41,108,40,40

安全 此应用程序没有隐私跟踪程序 

此应用程序不包括任何用户或设备跟踪器。在静态分析期间没有找到任何跟踪器。

安全评分: ( rasmlar (5 dona) 31.8.955.76)