Voyager v1.0.4版本 - 安全评分 _南明离火移动安全分析平台

高危安全漏洞基本配置不安全地配置为允许到所有域的明文流量。

Scope:
*

高危安全漏洞如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击

CODE

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/applovin/impl/adview/a.java, line(s) 400,760,15
com/applovin/impl/vm.java, line(s) 36,4
com/mbridge/msdk/advanced/signal/NativeAdvancedExpandDialog.java, line(s) 189,15
com/mbridge/msdk/click/m.java, line(s) 191,15,16
com/mbridge/msdk/mbbanner/common/c/d.java, line(s) 443,14
com/mbridge/msdk/mbbanner/common/communication/BannerExpandDialog.java, line(s) 185,15
com/mbridge/msdk/nativex/view/BaseMBMediaView.java, line(s) 585,2327,24,25
com/mbridge/msdk/splash/signal/SplashExpandDialog.java, line(s) 189,15
com/mbridge/msdk/video/bt/module/MBridgeBTWebView.java, line(s) 355,13
com/mbridge/msdk/video/module/MBridgeAlertWebview.java, line(s) 94,6
com/mbridge/msdk/video/module/MBridgeH5EndCardView.java, line(s) 746,17
com/unity3d/services/core/webview/WebViewApp.java, line(s) 401,10,57,63,77,106
sg/bigo/ads/controller/landing/c.java, line(s) 292,17
sg/bigo/ads/core/mraid/c.java, line(s) 578,18,19

高危安全漏洞已启用远程WebView调试

CODE

已启用远程WebView调试
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing

Files:
com/applovin/impl/adview/AppLovinWebViewBase.java, line(s) 24,5
com/applovin/impl/adview/l.java, line(s) 26,6

高危安全漏洞应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。

CODE

应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
sg/bigo/ads/common/utils/o.java, line(s) 84,105

高危安全漏洞应用程序包含隐私跟踪程序

TRACKERS

此应用程序有多个9隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

中危安全漏洞 Activity (com.focus.browser.ui.MainActivity) 未被保护。

MANIFEST

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危安全漏洞 Service (com.focus.browser.nt.NotificationMonitorService) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.BIND_NOTIFICATION_LISTENER_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Service (com.focus.browser.fcm.FcmNotificationService) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.BIND_NOTIFICATION_LISTENER_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Broadcast Receiver (com.focus.browser.broad.WidgetPinnedReceiver) 未被保护。

MANIFEST

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危安全漏洞 Service (com.focus.browser.job.VoyagerJobService) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Activity (androidx.compose.ui.tooling.PreviewActivity) 未被保护。

MANIFEST

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危安全漏洞 Service (androidx.work.impl.background.systemjob.SystemJobService) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) 受权限保护, 但是应该检查权限的保护级别。

MANIFEST

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危安全漏洞文件可能包含硬编码的敏感信息，如用户名、密码、密钥等

CODE

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/applovin/impl/sdk/AppLovinSdkInitializationConfigurationImpl.java, line(s) 198,154
com/applovin/mediation/MaxSegment.java, line(s) 37
com/applovin/mediation/ads/MaxAdView.java, line(s) 129,119
com/applovin/mediation/ads/MaxAppOpenAd.java, line(s) 67,57
com/applovin/mediation/ads/MaxInterstitialAd.java, line(s) 76,66
com/applovin/mediation/ads/MaxRewardedAd.java, line(s) 87,77
com/applovin/mediation/ads/MaxRewardedInterstitialAd.java, line(s) 71,61
com/applovin/mediation/nativeAds/MaxNativeAdLoader.java, line(s) 70,65
com/applovin/sdk/AppLovinSdk.java, line(s) 230
com/applovin/sdk/AppLovinSdkSettings.java, line(s) 153
com/applovin/sdk/AppLovinWebViewActivity.java, line(s) 25
com/focus/browser/ad/data/AdConst.java, line(s) 29
com/focus/browser/browse/SimpleWebActivity.java, line(s) 32
com/focus/browser/db/entity/NfbSearchHistoryEntity.java, line(s) 79
com/focus/browser/net/RefreshNewsEntity.java, line(s) 22
com/focus/browser/notification/data/LocalDataCache.java, line(s) 24
com/focus/browser/notification/data/NotificationDataProviderImpl.java, line(s) 36,39,42
com/mbridge/msdk/MBridgeConstans.java, line(s) 16,51
com/mbridge/msdk/click/b/a.java, line(s) 35
com/mbridge/msdk/click/m.java, line(s) 288
com/mbridge/msdk/foundation/download/core/DownloadCommon.java, line(s) 21
com/mbridge/msdk/foundation/download/core/DownloaderReporter.java, line(s) 10
com/mbridge/msdk/foundation/entity/CampaignEx.java, line(s) 39
com/mbridge/msdk/foundation/entity/n.java, line(s) 273,283,741,752,96,109,183,485,609,231,624,173,204,546,213,556,133,242,636
com/mbridge/msdk/foundation/same/report/i.java, line(s) 652
com/mbridge/msdk/newreward/player/MBRewardVideoActivity.java, line(s) 44
com/mbridge/msdk/newreward/player/imodel/IBigTempModel.java, line(s) 10,13
com/mbridge/msdk/newreward/player/imodel/IECModel.java, line(s) 9,36,45,39,24,18,21,42,31
com/mbridge/msdk/newreward/player/imodel/IMoreOfferModel.java, line(s) 6,9,12,15
com/mbridge/msdk/newreward/player/imodel/IPlayModel.java, line(s) 12,35,44,64,73,38,50,67,70,41,29,23,26,61,47,32
com/mbridge/msdk/newreward/player/iview/IBaseWebView.java, line(s) 21,15,18
com/mbridge/msdk/newreward/player/iview/IMetaData.java, line(s) 18
com/mbridge/msdk/newreward/player/iview/IPlayTempleView.java, line(s) 12,15
com/mbridge/msdk/newreward/player/model/BigTemplateModel.java, line(s) 47
com/mbridge/msdk/newreward/player/model/ECTempleModel.java, line(s) 90,123,159,163
com/mbridge/msdk/newreward/player/model/MoreOfferModel.java, line(s) 51,43,39,47
com/mbridge/msdk/newreward/player/model/PlayTempleModel.java, line(s) 263,160,151,235,199
com/mbridge/msdk/newreward/player/model/WebTemplateModel.java, line(s) 233,162,153,197
com/mbridge/msdk/newreward/player/model/WebViewECModel.java, line(s) 96,131,171
com/mbridge/msdk/newreward/player/view/WebViewTemplate.java, line(s) 370,394,411
com/mbridge/msdk/newreward/player/view/ectemplate/WebViewEC.java, line(s) 154,178,193
com/mbridge/msdk/playercommon/exoplayer2/drm/DefaultDrmSessionManager.java, line(s) 37
com/mbridge/msdk/splash/view/BaseSplashPopView.java, line(s) 627
com/mbridge/msdk/video/dynview/moffer/MOfferModel.java, line(s) 116
com/unity3d/ads/core/configuration/GameServerIdReader.java, line(s) 12
com/unity3d/ads/core/data/datasource/AndroidMediationDataSource.java, line(s) 17,29
com/unity3d/ads/core/data/datasource/AndroidTcfDataSource.java, line(s) 13
com/unity3d/ads/metadata/InAppPurchaseMetaData.java, line(s) 6
com/unity3d/services/ads/gmascar/utils/ScarConstants.java, line(s) 4,5,6,7,9,10
com/unity3d/services/core/configuration/ExperimentObject.java, line(s) 7,8
com/unity3d/services/core/device/reader/DeviceInfoReaderFilterProvider.java, line(s) 11,12
com/unity3d/services/core/device/reader/JsonStorageKeyNames.java, line(s) 4,6,7,8,10,11,12,13,9,14,5,15,16,17
com/unity3d/services/core/properties/SdkProperties.java, line(s) 29
com/vungle/ads/internal/Constants.java, line(s) 10,22,49,13,34,73,19,37
com/vungle/ads/internal/model/Cookie.java, line(s) 28
com/vungle/ads/internal/signals/SignalManager.java, line(s) 38,42
com/vungle/ads/internal/task/CleanupJob.java, line(s) 27
com/vungle/ads/internal/task/CleanupJobKt.java, line(s) 11
sg/bigo/ads/api/AdConfig.java, line(s) 11
sg/bigo/ads/common/j/a.java, line(s) 57

中危安全漏洞应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库

CODE

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/mbridge/msdk/foundation/db/BatchReportDao.java, line(s) 6,79
com/mbridge/msdk/foundation/db/c.java, line(s) 5,55
com/mbridge/msdk/foundation/db/e.java, line(s) 6,185,467,1161
com/mbridge/msdk/foundation/db/g.java, line(s) 4,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95
com/mbridge/msdk/foundation/download/database/DatabaseHelper.java, line(s) 6,95,182,190
com/mbridge/msdk/newreward/function/d/c.java, line(s) 3,4,21,28,29
com/mbridge/msdk/tracker/b.java, line(s) 4,5,22,36,37,51,52
sg/bigo/ads/common/g/a/b.java, line(s) 4,5,37,38,39,40,41,63,66,69,70

中危安全漏洞 IP地址泄露

CODE

IP地址泄露


Files:
com/applovin/mediation/adapters/GoogleAdManagerMediationAdapter.java, line(s) 788
com/applovin/mediation/adapters/GoogleMediationAdapter.java, line(s) 841
com/applovin/mediation/adapters/bigoads/BuildConfig.java, line(s) 9
com/applovin/mediation/adapters/facebook/BuildConfig.java, line(s) 10
com/applovin/mediation/adapters/google/BuildConfig.java, line(s) 9
com/applovin/mediation/adapters/googleadmanager/BuildConfig.java, line(s) 9
com/applovin/mediation/adapters/mintegral/BuildConfig.java, line(s) 9
com/applovin/mediation/adapters/unityads/BuildConfig.java, line(s) 9
com/applovin/mediation/adapters/vungle/BuildConfig.java, line(s) 9
com/focus/browser/ui/speedtest/SpeedSpeedTestActivity.java, line(s) 272
com/mbridge/msdk/advanced/view/a.java, line(s) 54
sg/bigo/ads/core/player/a/d.java, line(s) 206,210,217

中危安全漏洞可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息

CODE

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/applovin/impl/adview/l.java, line(s) 24,20
com/mbridge/msdk/foundation/webview/BrowserView.java, line(s) 168,165
com/mbridge/msdk/mbsignalcommon/base/BaseWebView.java, line(s) 86,83
com/mbridge/msdk/newreward/player/view/hybrid/MBWebView.java, line(s) 52,49
com/unity3d/services/core/webview/WebView.java, line(s) 131,144
com/vungle/ads/internal/ui/view/MRAIDAdWidget.java, line(s) 147,142
sg/bigo/ads/ad/interstitial/a/a/c.java, line(s) 301,307

中危安全漏洞不安全的Web视图实现。可能存在WebView任意代码执行漏洞

CODE

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/focus/browser/ui/GameActivity.java, line(s) 94,87
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 318,302
com/unity3d/services/core/webview/WebView.java, line(s) 206,144

中危安全漏洞应用程序使用不安全的随机数生成器

CODE

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/applovin/impl/mq.java, line(s) 15
com/applovin/impl/wj.java, line(s) 4
com/applovin/impl/yp.java, line(s) 56
com/mbridge/msdk/dycreator/baseview/rewardpopview/MBAcquireRewardPopView.java, line(s) 27
com/mbridge/msdk/playercommon/exoplayer2/source/ShuffleOrder.java, line(s) 4
com/mbridge/msdk/playercommon/exoplayer2/trackselection/RandomTrackSelection.java, line(s) 7
com/mbridge/msdk/playercommon/exoplayer2/upstream/cache/CachedContentIndex.java, line(s) 21
com/mbridge/msdk/thrid/okhttp/OkHttpClient.java, line(s) 29
com/mbridge/msdk/thrid/okhttp/internal/ws/RealWebSocket.java, line(s) 28
com/mbridge/msdk/thrid/okhttp/internal/ws/WebSocketWriter.java, line(s) 9
com/unity3d/services/core/configuration/Configuration.java, line(s) 22
sg/bigo/ads/ad/interstitial/multi_img/view/IconListView.java, line(s) 12
sg/bigo/ads/common/utils/k.java, line(s) 9
sg/bigo/ads/common/utils/m.java, line(s) 6

中危安全漏洞 SHA-1是已知存在哈希冲突的弱哈希

CODE

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/applovin/impl/sdk/utils/StringUtils.java, line(s) 38
com/applovin/impl/vi.java, line(s) 371
com/unity3d/ads/core/data/datasource/AndroidStaticDeviceInfoDataSource.java, line(s) 259
com/unity3d/services/core/device/Device.java, line(s) 172

中危安全漏洞应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据

CODE

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/focus/browser/utils/RcConfigManager$init$1.java, line(s) 41
com/mbridge/msdk/foundation/same/report/b/d.java, line(s) 146
com/mbridge/msdk/foundation/tools/ag.java, line(s) 54,65,75
com/unity3d/ads/core/data/datasource/AndroidDynamicDeviceInfoDataSource.java, line(s) 443,490
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 55
com/vungle/ads/internal/platform/AndroidPlatform.java, line(s) 211
sg/bigo/ads/common/utils/p.java, line(s) 56,94
sg/bigo/ads/core/mraid/h.java, line(s) 335

中危安全漏洞 MD5是已知存在哈希冲突的弱哈希

CODE

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/focus/browser/utils/DeviceUtils.java, line(s) 84
com/mbridge/msdk/foundation/download/resource/MBResourceManager.java, line(s) 95
com/mbridge/msdk/foundation/tools/aa.java, line(s) 17,32
sg/bigo/ads/common/utils/m.java, line(s) 51

中危安全漏洞应用程序创建临时文件。敏感信息永远不应该被写进临时文件

CODE

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
com/mbridge/msdk/playercommon/exoplayer2/util/Util.java, line(s) 178

中危安全漏洞 Firebase远程配置已启用

FIREBASE

Firebase远程配置URL （ https://firebaseremoteconfig.googleapis.com/v1/projects/877201235247/namespaces/firebase:fetch?key=AIzaSyCFQsqiohbbqGjfcC9JZXu0pfvRodv_JHo ） 已启用。请确保这些配置不包含敏感信息。响应内容如下所示：

{
    "entries": {
        "VY_high_ecpm_t_vy": "",
        "access_opening_major": "{     \"permiss_vo_math_notification\": 5,     \"permiss_vo_math_flowindow\": 4,     \"permiss_vo_math_notimanager\": 3,     \"permiss_vo_math_defaultset\": 2,     \"permiss_vo_math_widget\": 1   }",
        "alert_win_up_times": "20",
        "bespoke_pause": "1800",
        "bespoke_times": "15",
        "cache_pause": "1800",
        "chance_low_elc_pause": "305",
        "clear_Voyager_max": "6",
        "clear_Voyager_min": "2",
        "clear_load_max": "6",
        "elc_show_value": "80",
        "frequent_point_cloud_control": "1",
        "gaame_win_pause": "1800",
        "low_elc_pause": "1800",
        "max_cache_times": "2",
        "max_gaame_win_times": "15",
        "max_low_elc_chance_times": "15",
        "max_low_elc_times": "15",
        "max_network_times": "3",
        "max_phone_detail_times": "15",
        "max_speed_up_times": "15",
        "max_tidings_times": "15",
        "min_begin_wait": "2",
        "network_pause": "1800",
        "phone_detail_pause": "1800",
        "speed_up_pause": "1800",
        "start_Voyager_max": "6",
        "start_Voyager_min": "2",
        "task_management": "3600",
        "tidings_pause": "1800",
        "win_float_nofi_confirm": "true",
        "win_float_noti_confirm": "true",
        "win_full_time_pause": "600",
        "win_loading_confirm": "true",
        "win_priority_level": "{     \"win_priority_level\": {         \"news_voyager_pop\": 9,         \"process_voyager_pop\": 8,         \"clear_voyager_pop\": 7,         \"game_voyager_pop\": 6,         \"power_voyager_pop\": 5,         \"question_voyager_pop\": 4,         \"speed_voyager_pop\": 3,         \"status_voyager_pop\": 2,         \"customize_voyager_pop\": 1     } }"
    },
    "state": "UPDATE",
    "templateVersion": "7"
}

中危安全漏洞此应用可能包含硬编码机密信息

SECRETS

从应用程序中识别出以下机密确保这些不是机密或私人信息
AdMob广告平台的=> "com.google.android.gms.ads.APPLICATION_ID" : "ca-app-pub-9232734288750486~8486501278"
"anythink_myoffer_feedback_violation_of_laws" : "Illegal"
"com.google.firebase.crashlytics.mapping_file_id" : "00000000000000000000000000000000"
"dyStrategy.privateAddress" : "privateAddress"
"google_api_key" : "AIzaSyCFQsqiohbbqGjfcC9JZXu0pfvRodv_JHo"
"google_app_id" : "1:877201235247:android:939307068ede307a4d95da"
"google_crash_reporting_api_key" : "AIzaSyCFQsqiohbbqGjfcC9JZXu0pfvRodv_JHo"
"tab_private" : "Private"
936dcbdd57fe235fd7cf61c2e93da3c4
DkPtYdQTLkfAW+xUhoPwJ7JgY7K0DkeAWrfXYN==
DFKwWgtuDkKwLZPwD+z8H+N/xj26Vjcdx5KanjKnxVN=
30941e7c618c048a93972a1fbabe44fe
Y7c14Z2TDbv/Y+xgHFeXDrcshBPUYFT=
DFK/HrQgJ+zQW+xUhoPBD+QqJk2MWrfXYN==
DFeuWkH0W+xUhoPwJ7JgY7K0DkeAWrfXYN==
92762936dcbdd57fe235fd7cf61c2e93da3c4
DFKwWgtuDkKwLZPwD+z8H+N/xj26Vjcdx5KyVj5GxVN=
DkP3hrKuHoPMH+zwL+fALkK/WQc5x5zH+TcincKNNVfWNVJcVM==
HSrCHRtOan6wp2kwOIGJC1RDtuSrF2mWVbio2aBcMHX9KF3iTJ1lLSzCKP1ZSo5yNolPNw1kCTtWpxELFF4ah1
87895958d432ae508cfa39d34a988141
DFKwWgtuDkKwLZPwD+z8H+N/xjK+n3eyNVx6ZVPn5jcincKZx5f5ncN=
05f6779156fb712bcc2f124861ef6581
HkzwDFeD4QuyLdx5igfZYcu9xTM9NN==
LdxThdi1WBKUL75ULBPwJ7JgY7K0DkeAWrfXYN==
0000016742C00BDA259000000168CE0F13200000016588840DCE7118A0002FBF1C31C3275D78
LdxThdi1WBKUL75ULBPBD+QqJk2MWrfXYN==
h7KsLkfPW+xUhoPBD+QqJk2MWrfXYN==
DFK/HrQgJ+zQW+xUhoPwJ7JgY7K0DkeAWrfXYN==
d3f15ac87cb2a04162b66b4b18439c45
258EAFA5-E914-47DA-95CA-C5AB0DC85B11
YkRXhr5AWBPfNgzuH7JQ+2Ha
h7KsLkfPW+xUhoPwJ7JgY7K0DkeAWrfXYN==
DFKwWgtuDkKwLZPwD+z8H+N/xjQZxVfV+T2SZVe6V2xS5c5n

安全提示信息应用程序记录日志信息,不得记录敏感信息

CODE

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
com/alex/AlexMaxBannerAdapter.java, line(s) 124
com/alex/AlexMaxInterstitialAdapter.java, line(s) 81
com/alex/AlexMaxManualNativeAd.java, line(s) 108,113
com/alex/AlexMaxRewardedVideoAdapter.java, line(s) 144
com/anythink/banner/api/ATBannerView.java, line(s) 384,400,405,565
com/anythink/interstitial/a/a.java, line(s) 79
com/anythink/interstitial/a/c.java, line(s) 81,225,230,235,132,134,173,175
com/anythink/interstitial/api/ATInterstitial.java, line(s) 221,232,245
com/applovin/impl/pc.java, line(s) 77,54,48,32
com/applovin/impl/qg.java, line(s) 45,49,55
com/applovin/impl/sdk/p.java, line(s) 34,119,24,127,44,70,50,107
com/applovin/mediation/adapters/BigoAdsMediationAdapter.java, line(s) 519
com/focus/browser/ad/AdInitializer$topOnSdkInit$1.java, line(s) 58
com/focus/browser/cache/BaseAdPreloader$registerCollector$1.java, line(s) 62
com/focus/browser/ext/CommonExtKt.java, line(s) 29,42
com/focus/browser/notification/api/HighMsgWrapImpl.java, line(s) 49,58,65
com/focus/browser/notification/api/LowMsgWrapImpl.java, line(s) 123
com/focus/browser/notification/api/SchedulerFEventStrategyImpl$handle$2.java, line(s) 62
com/focus/browser/notification/api/SchedulerFEventStrategyImpl$startUp$1.java, line(s) 71,82,92
com/focus/browser/notification/api/chain/interceptor/UserProtectInterceptor.java, line(s) 54,61,69,77,87
com/focus/browser/notification/data/NotificationConfig.java, line(s) 950
com/focus/browser/nt/viewmodel/NtManageListViewModel.java, line(s) 142
com/focus/browser/ui/MainActivity.java, line(s) 825
com/focus/browser/utils/statistics/AdjustLifecycle.java, line(s) 19
com/iab/omid/library/applovin/publisher/b.java, line(s) 31,33
com/iab/omid/library/applovin/utils/d.java, line(s) 25,11,18
com/iab/omid/library/bigosg/d/c.java, line(s) 18,11
com/iab/omid/library/mmadbridge/publisher/b.java, line(s) 31,33
com/iab/omid/library/mmadbridge/utils/d.java, line(s) 25,11,18
com/iab/omid/library/unity3d/publisher/b.java, line(s) 30,32
com/iab/omid/library/unity3d/utils/d.java, line(s) 18,11
com/iab/omid/library/vungle/publisher/b.java, line(s) 31,33
com/iab/omid/library/vungle/utils/d.java, line(s) 25,11,18
com/mbridge/msdk/dycreator/a/a.java, line(s) 272
com/mbridge/msdk/dycreator/baseview/MBScrollView.java, line(s) 159
com/mbridge/msdk/dycreator/baseview/extview/MBExtAcquireRewardPopView.java, line(s) 198
com/mbridge/msdk/dycreator/baseview/extview/MBExtFeedBackView.java, line(s) 241
com/mbridge/msdk/dycreator/baseview/extview/MBExtMBridgeBaitClickView.java, line(s) 200
com/mbridge/msdk/dycreator/baseview/extview/MBExtMBridgeTextView.java, line(s) 250
com/mbridge/msdk/dycreator/bus/BackgroundPoster.java, line(s) 47
com/mbridge/msdk/dycreator/bus/EventBus.java, line(s) 160,488,490,494,241,331,386
com/mbridge/msdk/dycreator/e/g.java, line(s) 11
com/mbridge/msdk/foundation/same/b/e.java, line(s) 65
com/mbridge/msdk/foundation/same/report/b/b.java, line(s) 75
com/mbridge/msdk/foundation/same/report/b/d.java, line(s) 65
com/mbridge/msdk/foundation/same/report/d.java, line(s) 75
com/mbridge/msdk/foundation/tools/aa.java, line(s) 19
com/mbridge/msdk/foundation/tools/ad.java, line(s) 35,81,42,63,49,56,74,88
com/mbridge/msdk/mbnative/controller/NativeController.java, line(s) 1619
com/mbridge/msdk/mbnative/controller/d.java, line(s) 500
com/mbridge/msdk/mbnative/e/b.java, line(s) 75
com/mbridge/msdk/playercommon/exoplayer2/DefaultRenderersFactory.java, line(s) 75
com/mbridge/msdk/playercommon/exoplayer2/ExoPlayerImpl.java, line(s) 130,499,599
com/mbridge/msdk/playercommon/exoplayer2/ExoPlayerImplInternal.java, line(s) 630,809,1149,1154,1159,1221
com/mbridge/msdk/playercommon/exoplayer2/MediaPeriodHolder.java, line(s) 169
com/mbridge/msdk/playercommon/exoplayer2/SimpleExoPlayer.java, line(s) 263,795
com/mbridge/msdk/playercommon/exoplayer2/audio/DefaultAudioSink.java, line(s) 640,185,202,219,671
com/mbridge/msdk/playercommon/exoplayer2/drm/ClearKeyUtil.java, line(s) 45
com/mbridge/msdk/playercommon/exoplayer2/drm/DefaultDrmSession.java, line(s) 182,330
com/mbridge/msdk/playercommon/exoplayer2/drm/DefaultDrmSessionManager.java, line(s) 222
com/mbridge/msdk/playercommon/exoplayer2/extractor/mkv/MatroskaExtractor.java, line(s) 488
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp3/VbriSeeker.java, line(s) 68
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp3/XingSeeker.java, line(s) 47
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp4/FragmentedMp4Extractor.java, line(s) 263,1006
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp4/MetadataUtil.java, line(s) 171,59,66,193,237,249,259
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp4/PsshAtomUtil.java, line(s) 70
com/mbridge/msdk/playercommon/exoplayer2/extractor/mp4/TrackEncryptionBox.java, line(s) 64
com/mbridge/msdk/playercommon/exoplayer2/extractor/ogg/VorbisUtil.java, line(s) 211
com/mbridge/msdk/playercommon/exoplayer2/extractor/ts/AdtsReader.java, line(s) 107
com/mbridge/msdk/playercommon/exoplayer2/extractor/ts/Id3Reader.java, line(s) 32
com/mbridge/msdk/playercommon/exoplayer2/extractor/ts/PesReader.java, line(s) 111,114
com/mbridge/msdk/playercommon/exoplayer2/extractor/wav/WavHeaderReader.java, line(s) 48
com/mbridge/msdk/playercommon/exoplayer2/mediacodec/MediaCodecInfo.java, line(s) 103,114,54
com/mbridge/msdk/playercommon/exoplayer2/mediacodec/MediaCodecRenderer.java, line(s) 591
com/mbridge/msdk/playercommon/exoplayer2/mediacodec/MediaCodecUtil.java, line(s) 443,258,267,276,283,286,320,343,348,356,365
com/mbridge/msdk/playercommon/exoplayer2/metadata/id3/Id3Decoder.java, line(s) 192,206,374
com/mbridge/msdk/playercommon/exoplayer2/offline/DownloadManager.java, line(s) 304,441
com/mbridge/msdk/playercommon/exoplayer2/offline/DownloadService.java, line(s) 152
com/mbridge/msdk/playercommon/exoplayer2/source/chunk/BaseMediaChunkOutput.java, line(s) 49
com/mbridge/msdk/playercommon/exoplayer2/source/chunk/ChunkedTrackBlacklistUtil.java, line(s) 34,38
com/mbridge/msdk/playercommon/exoplayer2/text/cea/Cea708Decoder.java, line(s) 888,788,800
com/mbridge/msdk/playercommon/exoplayer2/text/cea/CeaUtil.java, line(s) 27
com/mbridge/msdk/playercommon/exoplayer2/text/dvb/DvbParser.java, line(s) 681
com/mbridge/msdk/playercommon/exoplayer2/text/ssa/SsaDecoder.java, line(s) 37,42,47,56
com/mbridge/msdk/playercommon/exoplayer2/text/subrip/SubripDecoder.java, line(s) 45,73,76
com/mbridge/msdk/playercommon/exoplayer2/text/ttml/TtmlDecoder.java, line(s) 581,89,100,116,262,268,277,282,304,308,523,532,541,592
com/mbridge/msdk/playercommon/exoplayer2/text/webvtt/WebvttCue.java, line(s) 61
com/mbridge/msdk/playercommon/exoplayer2/text/webvtt/WebvttCueParser.java, line(s) 121,252,255,355,384,428
com/mbridge/msdk/playercommon/exoplayer2/upstream/DefaultDataSource.java, line(s) 71
com/mbridge/msdk/playercommon/exoplayer2/upstream/DefaultHttpDataSource.java, line(s) 63
com/mbridge/msdk/playercommon/exoplayer2/upstream/Loader.java, line(s) 129,179,191,197
com/mbridge/msdk/playercommon/exoplayer2/upstream/cache/CachedRegionTracker.java, line(s) 137
com/mbridge/msdk/playercommon/exoplayer2/upstream/cache/SimpleCache.java, line(s) 87
com/mbridge/msdk/playercommon/exoplayer2/util/AtomicFile.java, line(s) 36,94
com/mbridge/msdk/playercommon/exoplayer2/util/EventLogger.java, line(s) 124,128
com/mbridge/msdk/playercommon/exoplayer2/video/DummySurface.java, line(s) 86,92
com/mbridge/msdk/playercommon/exoplayer2/video/MediaCodecVideoRenderer.java, line(s) 782,373,379,602
com/mbridge/msdk/tracker/b.java, line(s) 25,40,55
com/mbridge/msdk/tracker/c.java, line(s) 32,47,65,86,105,127,154,175,189,209,225,250,278,303,316,333,351,375,393
com/mbridge/msdk/tracker/j.java, line(s) 30
com/mbridge/msdk/tracker/k.java, line(s) 50,57,258,271,281
com/mbridge/msdk/tracker/m.java, line(s) 137,35,63,70,119,167
com/mbridge/msdk/tracker/n.java, line(s) 39,62,95,121
com/mbridge/msdk/tracker/network/ae.java, line(s) 44,48,83
com/mbridge/msdk/tracker/p.java, line(s) 33
com/mbridge/msdk/tracker/r.java, line(s) 39,152,162,277,291,307,50,60,121,168,173,185
com/mbridge/msdk/tracker/w.java, line(s) 98,101,104
com/mbridge/msdk/tracker/y.java, line(s) 132
com/mbridge/msdk/video/module/MBridgeBaseView.java, line(s) 158,170
com/mbridge/msdk/widget/FeedbackRadioGroup.java, line(s) 60
com/unity3d/ads/UnityAdsBaseOptions.java, line(s) 30
com/unity3d/ads/adplayer/CommonWebViewBridge.java, line(s) 200
com/unity3d/ads/adplayer/GetAdAssetLoaderKt.java, line(s) 41
com/unity3d/ads/adplayer/GetWebViewAssetLoaderKt.java, line(s) 52
com/unity3d/ads/core/data/datasource/AndroidDynamicDeviceInfoDataSource.java, line(s) 141,178,355,589,314
com/unity3d/ads/core/data/datasource/AndroidStaticDeviceInfoDataSource.java, line(s) 223,241,263,292,340,467,492,508,510,529
com/unity3d/ads/core/data/repository/AndroidDiagnosticEventRepository.java, line(s) 190
com/unity3d/ads/core/domain/InitializeAndroidBoldSDK.java, line(s) 142,151
com/unity3d/ads/core/domain/LegacyLoadUseCase.java, line(s) 202,217
com/unity3d/ads/core/domain/LegacyShowUseCase$showError$1.java, line(s) 103
com/unity3d/ads/core/domain/LegacyShowUseCase.java, line(s) 126,178,185,200
com/unity3d/ads/gatewayclient/CommonGatewayClient.java, line(s) 92
com/unity3d/ads/metadata/MetaData.java, line(s) 34,49
com/unity3d/services/SDKErrorHandler.java, line(s) 109
com/unity3d/services/UnityServices.java, line(s) 92,154,161,166,174,180,189,195,186,198,129
com/unity3d/services/ads/UnityAdsImplementation.java, line(s) 94,207
com/unity3d/services/ads/adunit/AdUnitActivityController.java, line(s) 359,361,52,128,186,219,260,290,310,376,224
com/unity3d/services/ads/adunit/AdUnitViewHandlerFactory.java, line(s) 22
com/unity3d/services/ads/adunit/VideoPlayerHandler.java, line(s) 18,34
com/unity3d/services/ads/api/AdUnit.java, line(s) 204,210,259,262,266,269,472,475,478,481,504,111,133,156,164,342,426,495,508,513,518
com/unity3d/services/ads/api/VideoPlayer.java, line(s) 59,77,100,149,160,178
com/unity3d/services/ads/api/WebPlayer.java, line(s) 52
com/unity3d/services/ads/gmascar/adapters/ScarAdapterFactory.java, line(s) 43
com/unity3d/services/ads/gmascar/bridges/AdapterStatusBridge.java, line(s) 21,39
com/unity3d/services/ads/gmascar/bridges/InitializeListenerBridge.java, line(s) 22,41
com/unity3d/services/ads/gmascar/bridges/mobileads/MobileAdsBridge.java, line(s) 21
com/unity3d/services/ads/gmascar/bridges/mobileads/MobileAdsBridgeLegacy.java, line(s) 20
com/unity3d/services/ads/gmascar/finder/GMAInitializer.java, line(s) 53
com/unity3d/services/ads/gmascar/finder/ScarVersionFinder.java, line(s) 37,49
com/unity3d/services/ads/token/InMemoryAsyncTokenStorage.java, line(s) 147,184
com/unity3d/services/ads/token/NativeTokenGenerator.java, line(s) 35
com/unity3d/services/ads/topics/TopicsReceiver.java, line(s) 51
com/unity3d/services/ads/topics/TopicsService.java, line(s) 66
com/unity3d/services/ads/video/VideoPlayerView.java, line(s) 43,45,63,102,107,129,172,184,216
com/unity3d/services/ads/webplayer/WebPlayerView.java, line(s) 64,70,295,337,388,403,418,431,639,641,658
com/unity3d/services/banners/BannerView.java, line(s) 152
com/unity3d/services/banners/UnityBanners.java, line(s) 340
com/unity3d/services/core/api/Cache.java, line(s) 167,181,57,133,186,282,290,312
com/unity3d/services/core/api/DeviceInfo.java, line(s) 142,160,187,325,350,364,418
com/unity3d/services/core/api/Intent.java, line(s) 49,63,209,233,248
com/unity3d/services/core/api/Request.java, line(s) 33,45,96,108,126,138
com/unity3d/services/core/api/Sdk.java, line(s) 17,38,54,61,67,73,79
com/unity3d/services/core/broadcast/BroadcastEventReceiver.java, line(s) 39
com/unity3d/services/core/cache/CacheDirectory.java, line(s) 25,27,66,70,79,104,108,114,121,30,59,74
com/unity3d/services/core/cache/CacheThread.java, line(s) 80
com/unity3d/services/core/cache/CacheThreadHandler.java, line(s) 37,40,44,67
com/unity3d/services/core/configuration/ConfigurationReader.java, line(s) 25
com/unity3d/services/core/configuration/ConfigurationRequestFactory.java, line(s) 32
com/unity3d/services/core/configuration/EnvironmentCheck.java, line(s) 29,41,32,44,47,50,53
com/unity3d/services/core/configuration/ExperimentObject.java, line(s) 24
com/unity3d/services/core/configuration/ExperimentsReader.java, line(s) 25
com/unity3d/services/core/configuration/InitializationNotificationCenter.java, line(s) 52
com/unity3d/services/core/configuration/InitializeEventsMetricSender.java, line(s) 42,52,60,70,165,172
com/unity3d/services/core/configuration/InitializeThread.java, line(s) 276,312,439,454,498,506,606,618,645,702,127,285,288,319,322,367,387,555,592,706,857,866,198,348,448,532
com/unity3d/services/core/configuration/PrivacyConfigurationLoader.java, line(s) 63
com/unity3d/services/core/connectivity/ConnectivityMonitor.java, line(s) 56,85,95,76,125
com/unity3d/services/core/device/AdvertisingId.java, line(s) 127,145,155
com/unity3d/services/core/device/Device.java, line(s) 174,498,549,558,304
com/unity3d/services/core/device/OpenAdvertisingId.java, line(s) 129,151,158
com/unity3d/services/core/device/Storage.java, line(s) 103,106,120
com/unity3d/services/core/device/reader/DeviceInfoReaderCompressor.java, line(s) 20,33
com/unity3d/services/core/device/reader/DeviceInfoReaderExtended.java, line(s) 47,53
com/unity3d/services/core/domain/task/InitializeStateConfig$doWork$2.java, line(s) 60
com/unity3d/services/core/domain/task/InitializeStateCreate$doWork$2.java, line(s) 53,59,70
com/unity3d/services/core/domain/task/InitializeStateError$doWork$2.java, line(s) 50
com/unity3d/services/core/domain/task/InitializeStateLoadCache.java, line(s) 164
com/unity3d/services/core/domain/task/InitializeStateNetworkError$doWork$2.java, line(s) 54
com/unity3d/services/core/domain/task/InitializeStateNetworkError.java, line(s) 110,127
com/unity3d/services/core/log/DeviceLog.java, line(s) 70,202,209
com/unity3d/services/core/misc/JsonFlattener.java, line(s) 44
com/unity3d/services/core/misc/JsonStorage.java, line(s) 160,26,32,51,72,84,96,169,175
com/unity3d/services/core/misc/JsonStorageAggregator.java, line(s) 34
com/unity3d/services/core/misc/Utilities.java, line(s) 128,145,179
com/unity3d/services/core/misc/ViewUtilities.java, line(s) 25,33
com/unity3d/services/core/preferences/AndroidPreferences.java, line(s) 17,31,45,59,73
com/unity3d/services/core/properties/ClientProperties.java, line(s) 40,71,83,85
com/unity3d/services/core/properties/SdkProperties.java, line(s) 236,238,99
com/unity3d/services/core/reflection/GenericBridge.java, line(s) 32,47,56,62,70,76,84,91
com/unity3d/services/core/request/WebRequest.java, line(s) 69,161,164
com/unity3d/services/core/request/WebRequestRunnable.java, line(s) 96,81,100,110
com/unity3d/services/core/request/WebRequestThread.java, line(s) 68,120,135
com/unity3d/services/core/request/metrics/MetricCommonTags.java, line(s) 73
com/unity3d/services/core/request/metrics/MetricSender$sendMetrics$$inlined$CoroutineExceptionHandler$1.java, line(s) 23
com/unity3d/services/core/request/metrics/MetricSender$sendMetrics$1.java, line(s) 78,80
com/unity3d/services/core/request/metrics/MetricSender.java, line(s) 87,100,108
com/unity3d/services/core/request/metrics/MetricSenderWithBatch.java, line(s) 48
com/unity3d/services/core/request/metrics/SDKMetrics.java, line(s) 32,37,47,84,95
com/unity3d/services/core/sensorinfo/SensorInfoListener.java, line(s) 28
com/unity3d/services/core/timer/BaseTimer.java, line(s) 77
com/unity3d/services/core/webview/WebView.java, line(s) 80
com/unity3d/services/core/webview/WebViewApp.java, line(s) 59,107,159,204,260,325,66,70,73,90,134,240,252,282,297,338,353,388,404
com/unity3d/services/core/webview/WebViewUrlBuilder.java, line(s) 30
com/unity3d/services/core/webview/bridge/Invocation.java, line(s) 70
com/unity3d/services/core/webview/bridge/NativeCallback.java, line(s) 39
com/unity3d/services/core/webview/bridge/WebViewBridge.java, line(s) 91
com/unity3d/services/core/webview/bridge/WebViewBridgeInterface.java, line(s) 37,44
com/unity3d/services/core/webview/bridge/WebViewCallback.java, line(s) 72
com/unity3d/services/store/core/StoreLifecycleListener.java, line(s) 61
com/unity3d/services/store/gpbl/bridges/CommonJsonResponseBridge.java, line(s) 34
com/unity3d/services/store/gpbl/bridges/PurchaseBridge.java, line(s) 38
com/vungle/ads/internal/util/Logger.java, line(s) 31,41,89,63,100,73,111
sg/bigo/ads/common/view/AutoNextLineLinearLayout.java, line(s) 53

安全提示信息此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它

CODE

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
com/focus/browser/ui/scan/QRScanResultActivity.java, line(s) 4,37,38
sg/bigo/ads/common/utils/c.java, line(s) 5,95

已通过安全项此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击

CODE

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
com/focus/browser/net/RetrofitClientFactory.java, line(s) 37,37
com/mbridge/msdk/thrid/okhttp/internal/Util.java, line(s) 406,405,404,404

重点安全关注应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.googletagmanager.com) 通信。

DOMAINS

{'ip': '180.163.150.41', 'country_short': 'CN', 'country_long': '中国', 'region': '上海', 'city': '上海', 'latitude': '31.224333', 'longitude': '121.468948'}

重点安全关注应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.adsbigo.com) 通信。

DOMAINS

{'ip': '124.95.186.146', 'country_short': 'CN', 'country_long': '中国', 'region': '辽宁', 'city': '沈阳', 'latitude': '41.792221', 'longitude': '123.432877'}

移动应用安全检测报告： Voyager v1.0.4

安全基线评分

安全基线评分 43/100

综合风险等级

风险等级评定

漏洞与安全项分布（%）

隐私风险

检测到的第三方跟踪器数量

检测结果分布

高危安全漏洞 基本配置不安全地配置为允许到所有域的明文流量。

高危安全漏洞 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击

高危安全漏洞 已启用远程WebView调试

高危安全漏洞 应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。

高危安全漏洞 应用程序包含隐私跟踪程序

中危安全漏洞 Activity (com.focus.browser.ui.MainActivity) 未被保护。

中危安全漏洞 Service (com.focus.browser.nt.NotificationMonitorService) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Service (com.focus.browser.fcm.FcmNotificationService) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Broadcast Receiver (com.focus.browser.broad.WidgetPinnedReceiver) 未被保护。

中危安全漏洞 Service (com.focus.browser.job.VoyagerJobService) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Activity (androidx.compose.ui.tooling.PreviewActivity) 未被保护。

中危安全漏洞 Service (androidx.work.impl.background.systemjob.SystemJobService) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) 受权限保护, 但是应该检查权限的保护级别。

中危安全漏洞 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等

中危安全漏洞 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库

中危安全漏洞 IP地址泄露

中危安全漏洞 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息

中危安全漏洞 不安全的Web视图实现。可能存在WebView任意代码执行漏洞

中危安全漏洞 应用程序使用不安全的随机数生成器

中危安全漏洞 SHA-1是已知存在哈希冲突的弱哈希

中危安全漏洞 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据

中危安全漏洞 MD5是已知存在哈希冲突的弱哈希

中危安全漏洞 应用程序创建临时文件。敏感信息永远不应该被写进临时文件

中危安全漏洞 Firebase远程配置已启用

中危安全漏洞 此应用可能包含硬编码机密信息

安全提示信息 应用程序记录日志信息,不得记录敏感信息

安全提示信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它

已通过安全项 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击

重点安全关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.googletagmanager.com) 通信。

重点安全关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.adsbigo.com) 通信。

综合安全基线评分: ( Voyager 1.0.4)

高危安全漏洞基本配置不安全地配置为允许到所有域的明文流量。

高危安全漏洞如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击

高危安全漏洞已启用远程WebView调试

高危安全漏洞应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。

高危安全漏洞应用程序包含隐私跟踪程序

中危安全漏洞文件可能包含硬编码的敏感信息，如用户名、密码、密钥等

中危安全漏洞应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库

中危安全漏洞可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息

中危安全漏洞不安全的Web视图实现。可能存在WebView任意代码执行漏洞

中危安全漏洞应用程序使用不安全的随机数生成器

中危安全漏洞应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据

中危安全漏洞应用程序创建临时文件。敏感信息永远不应该被写进临时文件

中危安全漏洞此应用可能包含硬编码机密信息

安全提示信息应用程序记录日志信息,不得记录敏感信息

安全提示信息此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它

已通过安全项此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击

重点安全关注应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.googletagmanager.com) 通信。

重点安全关注应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.adsbigo.com) 通信。