安全分析报告： 糖心Vlog v4.4.0

安全分数


安全分数 52/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

0

用户/设备跟踪器


调研结果

高危 1
中危 8
信息 1
安全 1
关注 1

高危 应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。 

应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
t4/a.java, line(s) 85

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据存在被泄露的风险 

未设置[android:allowBackup]标志
这个标志 [android:allowBackup]应该设置为false。默认情况下它被设置为true，允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/example/r_upgrade/common/a.java, line(s) 8,9,94
i3/b0.java, line(s) 5,6,82
i3/f0.java, line(s) 3,19
i3/h0.java, line(s) 4,5,96
r8/i.java, line(s) 9,10,11,12,13,211

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
gb/a.java, line(s) 3
gb/b.java, line(s) 4
hb/a.java, line(s) 5
j$/util/concurrent/ThreadLocalRandom.java, line(s) 10
m8/d.java, line(s) 4
n3/q1.java, line(s) 6
o4/p0.java, line(s) 4
r4/b.java, line(s) 13
ub/c.java, line(s) 14

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/example/r_upgrade/common/UpgradeService.java, line(s) 192,192
g2/b.java, line(s) 42
k2/b.java, line(s) 22
la/h.java, line(s) 108,130
la/i.java, line(s) 99
n2/a.java, line(s) 47
n2/b.java, line(s) 27
n2/c.java, line(s) 232
v2/e.java, line(s) 233,787

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/dexterous/flutterlocalnotifications/FlutterLocalNotificationsPlugin.java, line(s) 126
com/dexterous/flutterlocalnotifications/models/NotificationDetails.java, line(s) 55,69
f1/g.java, line(s) 79
h1/d.java, line(s) 37
h1/p.java, line(s) 95
h1/x.java, line(s) 84
u2/f.java, line(s) 43

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
o/q.java, line(s) 131
u9/q.java, line(s) 438,657

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
9a04f079-9840-4286-ab92-e65be0885f95
edef8ba9-79d6-4ace-a3c8-27dcd51d21ed
c06c8400-8e06-11e0-9cb6-0002a5d5c51b
16a09e667f3bcc908b2fb1366ea957d3e3adec17512775099da2f590b0667322a
VGhpcyBpcyB0aGUgcHJlZml4IGZvciBCaWdJbnRlZ2Vy
bb392ec0-8d4d-11e0-a896-0002a5d5c51b
e2719d58-a985-b3c9-781a-b030af78d30e

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
a0/j.java, line(s) 183,199,205,226,257,267,305,313,182,198,204,225,256,266,304,312,136,208,231,248
b1/a.java, line(s) 17
b1/n.java, line(s) 50,70,74,262,270,276,284
b1/o.java, line(s) 267,271,276
b1/p.java, line(s) 55
b2/a.java, line(s) 72,73
b6/b.java, line(s) 36,100
c3/k.java, line(s) 36,65,72,75,92,97,102,107,112
com/arthenica/ffmpegkit/FFmpegKitConfig.java, line(s) 378,382,426,430,626,298,361,433,596,604,637,728,730,740,743,767,776,191,193,629,640,253,632,684,695,707
com/arthenica/ffmpegkit/b.java, line(s) 93,131
com/arthenica/ffmpegkit/c.java, line(s) 24,32
com/arthenica/ffmpegkit/d.java, line(s) 24,32
com/arthenica/ffmpegkit/e.java, line(s) 27,35
com/arthenica/ffmpegkit/h.java, line(s) 38
com/arthenica/ffmpegkit/u.java, line(s) 58
com/cloudwebrtc/webrtc/CameraEventsHandler.java, line(s) 11,16,21,26,31,36
com/cloudwebrtc/webrtc/FlutterRTCVideoRenderer.java, line(s) 92,191,184,188
com/cloudwebrtc/webrtc/FlutterWebRTCPlugin.java, line(s) 147,102
com/cloudwebrtc/webrtc/GetUserMediaImpl.java, line(s) 211,215,221,230,244,389,412,415,446,505,536,571,834,837,225,337,687,329,410
com/cloudwebrtc/webrtc/MethodCallHandlerImpl.java, line(s) 455,494,503,512,810,816,831,1723,1732,1739,1808,1819,1849,1863,1973,2063,2086,835,828
com/cloudwebrtc/webrtc/OrientationAwareScreenCapturer.java, line(s) 35
com/cloudwebrtc/webrtc/PeerConnectionObserver.java, line(s) 350,691,703,938,954,1030,1083,1105,1119,1136,1167,1193
com/cloudwebrtc/webrtc/record/MediaRecorderImpl.java, line(s) 35
com/cloudwebrtc/webrtc/record/VideoFileRenderer.java, line(s) 99,104,148,163,189,84,89,122,185,210,238
com/cloudwebrtc/webrtc/utils/MediaConstraintsUtils.java, line(s) 60,71
com/dexterous/flutterlocalnotifications/ActionBroadcastReceiver.java, line(s) 70,79
d1/a.java, line(s) 324
e1/d.java, line(s) 76,103,75,102
e1/e.java, line(s) 611,632,650,610,631,649
e3/a.java, line(s) 7,11,15,23,27
e9/b.java, line(s) 10,14,28,32,36
f8/e.java, line(s) 29,22,18,24
g0/e.java, line(s) 30,34,38
g1/c.java, line(s) 111,110
g1/e.java, line(s) 58,117,57,116
g2/b.java, line(s) 255
h1/h.java, line(s) 638,349,363,637,455
h1/i.java, line(s) 51,52
h1/k.java, line(s) 14,214
h1/q.java, line(s) 165
h1/z.java, line(s) 76,118,66,75,117,67
i1/i.java, line(s) 110,150,111,151
i1/j.java, line(s) 117,158,169,181,83,116,126,147,157,168,180,211,218,89,127,212,219,148
i2/c.java, line(s) 20
j1/e.java, line(s) 45,55,69,75,106,46,70,58,76,107
j1/i.java, line(s) 123,107
j5/r.java, line(s) 33,43,38,28
j6/a.java, line(s) 82,86
ja/a.java, line(s) 18,21
k1/a.java, line(s) 169,166
l1/c.java, line(s) 16,15
l1/d.java, line(s) 44,43
l1/f.java, line(s) 104,103
l1/s.java, line(s) 82,85
l1/t.java, line(s) 37,36
l7/m.java, line(s) 148,152,187
la/i.java, line(s) 143
ma/l.java, line(s) 79
n1/a.java, line(s) 75,76
n2/c.java, line(s) 147
na/i.java, line(s) 14,30,44
o/k0.java, line(s) 115,117,121,125,130
o1/c.java, line(s) 61,60,77,78
o1/d.java, line(s) 14,15
o1/h.java, line(s) 174,181,273,283,295,308,326,342,352,361,374,379,173,180,272,282,294,307,325,335,340,344,350,354,373,378
o1/j.java, line(s) 110,128,327,109,127,204,267,296,326,205,268,401
o1/k.java, line(s) 44,50,45,51
o1/n.java, line(s) 86,119,125,131,137,143,150,156,164,120,126,132,138,144,151,157,165,87
o1/x.java, line(s) 187,194,233,186,193,230
o5/d.java, line(s) 114,160,167
o5/g.java, line(s) 59,33,102,108,117,120
o5/h.java, line(s) 43
o5/k.java, line(s) 26
o5/r.java, line(s) 49
o5/v.java, line(s) 25
org/webrtc/audio/WebRtcAudioTrackUtils.java, line(s) 16,20,22,28,41,43
p0/a.java, line(s) 81
q5/c0.java, line(s) 50
r2/b.java, line(s) 259
r5/a.java, line(s) 18
r5/b0.java, line(s) 98,101,105,109,113,117,126,130,133,136,168,176
r5/c.java, line(s) 185,203,404,408,412,418
r5/d1.java, line(s) 53,58
r5/e0.java, line(s) 26
r5/g1.java, line(s) 50
r5/i.java, line(s) 33,39,45,28,51,57
r5/q0.java, line(s) 35
r5/t0.java, line(s) 101
r5/u0.java, line(s) 28
r5/v0.java, line(s) 36
r5/x0.java, line(s) 45
r6/f.java, line(s) 34,41,44,53,87
r6/m.java, line(s) 95
r8/c0.java, line(s) 84,102,165,180,231,244,250,267,272,339,348,408,88,343
r8/e0.java, line(s) 24
r8/i.java, line(s) 156,217,225,269,342,419,459,529,660,240,442
s1/a.java, line(s) 86,91,96,105,87,92,97,106
s1/d.java, line(s) 21,22
s1/j.java, line(s) 39,42
t/c.java, line(s) 20
u0/a.java, line(s) 17
u1/d.java, line(s) 44,51,62,67,43,50,55,61,66,56
u9/m0.java, line(s) 116,129,152,84,261
u9/q.java, line(s) 111,120,127,166,172,178,185,347,363,380,411,413,425,462,468,680,682,768,771,895,929,969,1000,1057,1061,732
u9/s.java, line(s) 81,92,106,116
v2/a.java, line(s) 687,692,729,733,738,743
v2/d.java, line(s) 640,645,650
v8/h.java, line(s) 36,46,27
w1/k.java, line(s) 157,15,288,114
w5/a.java, line(s) 57,68
w7/a.java, line(s) 94,110
x5/c.java, line(s) 17
x7/a.java, line(s) 98
x7/b.java, line(s) 116,154
x7/c.java, line(s) 31,42,52
y0/e.java, line(s) 17,25,33,41
y0/k.java, line(s) 98,420,513,537,670,834,846,852,868,430,444,515,654,661,731,761,1811,541,547,1764,1821,1831,1859,1875
y0/o.java, line(s) 28,31,34
y2/a.java, line(s) 23,33,43,53
zb/a.java, line(s) 164,222

安全 此应用程序没有隐私跟踪程序 

此应用程序不包括任何用户或设备跟踪器。在静态分析期间没有找到任何跟踪器。

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (app.mi.com) 通信。 

{'ip': '118.26.252.203', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

安全评分: ( 糖心Vlog 4.4.0)