安全分析报告： 北斗助手 v13

未设置[android:allowBackup]标志
这个标志 [android:allowBackup]应该设置为false。默认情况下它被设置为true，允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

存在一个intent-filter。
发现 Service与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Service是显式导出的。

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/baidu/b/d/c.java, line(s) 9
com/baidu/pano/platform/http/g.java, line(s) 24
com/baidu/sec/privacy/f/d.java, line(s) 262
d/b/a/a/a/a.java, line(s) 169

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/baidu/b/c/b/b.java, line(s) 8
com/lzxggdjj/xghdjj/utils/h.java, line(s) 4
com/scwang/smartrefresh/header/FunGameBattleCityHeader.java, line(s) 15
com/scwang/smartrefresh/header/TaurusHeader.java, line(s) 19
com/scwang/smartrefresh/header/b/a.java, line(s) 8
com/yingyongduoduo/ad/c/a.java, line(s) 36
com/zzti/fengyongge/imagepicker/view/SelectPhotoItem.java, line(s) 18

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/alibaba/idst/nui/CommonUtils.java, line(s) 370
com/alibaba/idst/nui/FileUtil.java, line(s) 28,152
com/baidu/b/g.java, line(s) 27,81,83
com/baidu/pano/platform/util/c.java, line(s) 170
com/baidu/vi/VDeviceAPI.java, line(s) 166,175
com/ss/android/downloadlib/addownload/di.java, line(s) 226
com/ss/android/downloadlib/addownload/f.java, line(s) 93,95
com/ss/android/downloadlib/xd/yg.java, line(s) 84,202,278
com/yingyongduoduo/ad/utils/b.java, line(s) 19,21,40
com/yingyongduoduo/ad/utils/e.java, line(s) 6
com/zzti/fengyongge/imagepicker/d/e.java, line(s) 54,60,68,69,70
com/zzti/fengyongge/imagepicker/d/f.java, line(s) 16,18,20

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/just/agentweb/a.java, line(s) 46,22

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/lzxggdjj/xghdjj/ui/activity/PolicyActivity.java, line(s) 69,71

IP地址泄露


Files:
com/ss/android/download/api/constant/BaseConstants.java, line(s) 36
com/ss/android/downloadlib/xd/di.java, line(s) 490

MD5是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/baidu/b/d/b.java, line(s) 26
com/baidu/pano/platform/util/l.java, line(s) 42
com/ss/android/zn/te.java, line(s) 120

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/ss/android/downloadlib/fp/c.java, line(s) 4,5,19

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/lzxggdjj/net/constants/Constant.java, line(s) 16,15

从应用程序中识别出以下机密确保这些不是机密或私人信息
百度地图的=> "com.baidu.lbsapi.API_KEY" : "Q4QTGAxoPs5AiaUtBZkVnSsFAZMPvQzw"
高德地图的=> "com.amap.api.v2.apikey" : "da212ee12f9335763918a6acb0fa5607"
凭证信息=> "com.baidu.APPId" : "26121596"
友盟统计的=> "UMENG_APPKEY" : "626a0b38d024421570d65cab"
ak=Pn6RXsWAtznkX92S4AmnXHjHDgOSvIa1
99754106633f94d350db34d548d6091a
ak=xwT112SxZ5ZBEA8GEDGO43VmGgEdXvvh
ak=tnFhCM9cTeTDZqNjRPVHbfzOz6AUPoEq