安全分析报告： ZStore v1.7

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/applovin/exoplayer2/h/z.java, line(s) 4
com/applovin/impl/c/m.java, line(s) 18
com/zackiestudios/zstore/AboutActivity.java, line(s) 42
com/zackiestudios/zstore/AccountActivity.java, line(s) 51
com/zackiestudios/zstore/CategoryActivity.java, line(s) 40
com/zackiestudios/zstore/CodeViewActivity.java, line(s) 40
com/zackiestudios/zstore/CodesActivity.java, line(s) 49
com/zackiestudios/zstore/CommentsActivity.java, line(s) 55
com/zackiestudios/zstore/DebugActivity.java, line(s) 40
com/zackiestudios/zstore/EditorActivity.java, line(s) 77
com/zackiestudios/zstore/FiledecoActivity.java, line(s) 40
com/zackiestudios/zstore/FiledownloadActivity.java, line(s) 42
com/zackiestudios/zstore/HomeActivity.java, line(s) 79
com/zackiestudios/zstore/ImagesActivity.java, line(s) 19
com/zackiestudios/zstore/JsonActivity.java, line(s) 65
com/zackiestudios/zstore/LoginActivity.java, line(s) 53
com/zackiestudios/zstore/MainActivity.java, line(s) 44
com/zackiestudios/zstore/MaintenanceActivity.java, line(s) 22
com/zackiestudios/zstore/NoInternetActivity.java, line(s) 17
com/zackiestudios/zstore/NotificationActivity.java, line(s) 46
com/zackiestudios/zstore/ProfileEditActivity.java, line(s) 61
com/zackiestudios/zstore/ProjectViewActivity.java, line(s) 72
com/zackiestudios/zstore/SearchActivity.java, line(s) 41
com/zackiestudios/zstore/SketchwareUtil.java, line(s) 28
com/zackiestudios/zstore/TutorialActivity.java, line(s) 44
com/zackiestudios/zstore/UploadActivity.java, line(s) 82
com/zackiestudios/zstore/ViewAllActivity.java, line(s) 44

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/applovin/impl/mediation/b/a/a.java, line(s) 36
com/applovin/impl/sdk/o.java, line(s) 1057
com/applovin/mediation/ads/MaxAdView.java, line(s) 113,108
com/applovin/mediation/ads/MaxAppOpenAd.java, line(s) 89,84
com/applovin/mediation/ads/MaxInterstitialAd.java, line(s) 123,118
com/applovin/mediation/ads/MaxRewardedAd.java, line(s) 113,108
com/applovin/mediation/ads/MaxRewardedInterstitialAd.java, line(s) 117,112
com/applovin/mediation/nativeAds/MaxNativeAdLoader.java, line(s) 97,92
com/applovin/sdk/AppLovinSdk.java, line(s) 245
com/applovin/sdk/AppLovinSdkSettings.java, line(s) 189
com/applovin/sdk/AppLovinWebViewActivity.java, line(s) 23
com/zackiestudios/zstore/CategoryActivity.java, line(s) 151
com/zackiestudios/zstore/HomeActivity.java, line(s) 2131,2123,2139
com/zackiestudios/zstore/NotificationActivity.java, line(s) 161
com/zackiestudios/zstore/TutorialActivity.java, line(s) 227

IP地址泄露


Files:
com/applovin/mediation/adapters/NimbusMediationAdapter.java, line(s) 31

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/applovin/impl/sdk/utils/StringUtils.java, line(s) 160
com/applovin/impl/sdk/utils/q.java, line(s) 317

向Firebase上传文件


Files:
com/zackiestudios/zstore/ProfileEditActivity.java, line(s) 453,55
com/zackiestudios/zstore/UploadActivity.java, line(s) 429,762,810,858,906,954,1037,74

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/zackiestudios/zstore/FileUtil.java, line(s) 331,656,327,335,345

此应用程序有多个3隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
AppLovin广告SDK的=> "applovin.sdk.key" : "wpEElBKHku9RN31m9D7CPclypVXsSUgWqcoCzly5xKA4AvK9CrWhoKUwb4vr6OUIoOArDE9SuesU6KhEBRs4WN"
"firebase_database_url" : "https://zstorestudios-default-rtdb.firebaseio.com"
"google_api_key" : "AIzaSyBVY5kdKPgVPOBrT59SKGlZjK2-tGGIlgQ"
HSrCHRtOan6wp2kwOIGJC1RDtuSrF2mWVbio2aBcMHX9KF3iTJ1lLSzCKP1ZSo5yNolPNw1kCTtWpxELFF4ah1
82714d6703b2578b5a5cd5
AIzaSyBbq27T6GGxJO0pPgo4h7f7pbvKj494Bcg