安全分析报告： PSP Dragon Emulator v1.0

Android 4.1-4.1.2, [minSdk=16]
该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

存在一个intent-filter。
发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
bolts/MeasurementEvent.java, line(s) 18,19
com/airpush/injector/internal/common/old/Config.java, line(s) 30,57
com/bumptech/glide/load/Option.java, line(s) 75
com/bumptech/glide/load/engine/DataCacheKey.java, line(s) 33
com/bumptech/glide/load/engine/EngineResource.java, line(s) 84
com/bumptech/glide/load/engine/ResourceCacheKey.java, line(s) 72
com/bumptech/glide/manager/RequestManagerRetriever.java, line(s) 36,35

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/SBStudio/PSP_PPSSPP_Emulator_Games/Activity/Konten.java, line(s) 244
com/airpush/injector/internal/common/old/Util.java, line(s) 687
com/airpush/injector/internal/common/utils/DeviceInfoUtils.java, line(s) 39
com/gamedragontoha/pspwaruirengcom/Activity/Konten.java, line(s) 244
com/nostra13/universalimageloader/utils/StorageUtils.java, line(s) 21,50,50,55,55,60
com/startapp/android/publish/common/commonUtils/n.java, line(s) 43

MD5是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/airpush/injector/internal/common/old/Util.java, line(s) 423,645
com/airpush/injector/internal/common/utils/ByteUtils.java, line(s) 17
com/nostra13/universalimageloader/cache/disc/naming/Md5FileNameGenerator.java, line(s) 18
com/startapp/android/publish/ads/video/d.java, line(s) 37

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/airpush/injector/internal/common/old/Util.java, line(s) 443

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
bolts/WebViewAppLinkResolver.java, line(s) 114,89
com/airpush/injector/internal/ads/types/appwall/AppWallWebView.java, line(s) 33,80
com/airpush/injector/internal/ads/types/mraid/MraidWebView.java, line(s) 122,159
com/airpush/injector/internal/ads/types/overlay/OverlayWebView.java, line(s) 61,48,171
com/airpush/injector/internal/ads/types/vast/ContentBarView.java, line(s) 80,105
com/airpush/injector/internal/ads/types/vast/EndCardView.java, line(s) 101,104
com/airpush/injector/internal/ads/types/vast/web/VastWebPlayerView.java, line(s) 118,100
com/startapp/android/publish/ads/a/c.java, line(s) 123,110
com/startapp/android/publish/ads/banner/bannerstandard/BannerStandard.java, line(s) 266,198
com/startapp/android/publish/ads/splash/d.java, line(s) 30,26
com/startapp/android/publish/adsCommon/adinformation/b.java, line(s) 150,146

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/airpush/injector/internal/common/utils/StringUtils.java, line(s) 3
com/startapp/android/publish/ads/banner/Banner.java, line(s) 26
com/startapp/android/publish/ads/video/a/b.java, line(s) 8
com/startapp/android/publish/cache/a.java, line(s) 17
com/startapp/android/publish/cache/g.java, line(s) 17

IP地址泄露


Files:
com/airpush/injector/internal/common/utils/NetworkUtils.java, line(s) 71

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/airpush/injector/internal/statistics/StatisticsDbStorage.java, line(s) 6,203

从应用程序中识别出以下机密确保这些不是机密或私人信息
"com_facebook_device_auth_instructions" : "<b>facebook.com/device</b>にアクセスして、上のコードを入力してください。"
"com_facebook_device_auth_instructions" : "前往<b>facebook.com/device</b&gt，並輸入上方顯示的代碼。"
"com_facebook_device_auth_instructions" : "请访问<b>facebook.com/device</b>并输入以上验证码。"
"com_facebook_device_auth_instructions" : "前往<b>facebook.com/device</b&gt，並輸入上方顯示的代碼。"
7fd34eb33a471feb972c26d13e35f31b428536c3
3i2ndDfv2rTHiSisAbouNdArYfORhtTPEefj3q2f
Y29tLnBzcHdhcnVpcmVuZ2NvbS5nYW1lZHJhZ29udG9oYQ==
8a3c4b262d721acd49a4bf97d5213199c86fa2b9
5e8f16062ea3cd2c4a0d547876baa6f38cabf625
42893825-3d6a-41e1-9b47-93180fe2b3b2
Y29tLlNCU3R1ZGlvLlBTUF9QUFNTUFBfRW11bGF0b3JfR2FtZXM=
a4b7452e2ed8f5f191058ca7bbfd26b0d3214bfc
51ff84a4ebf155b7d3f554698421f4daf4e58cc8
470fa2b4ae81cd56ecbcda9735803434cec591fa
com/Vo9wbFH89BbDbWFhUezQZOGPKmfkJSAtIbVWk3QxPbvJwcR8I79EVuI0aB41a