-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
…/sk3l10x1ng/3073
- Loading branch information
Showing
97 changed files
with
1,419 additions
and
420 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,4 +29,5 @@ docs/assets/Images | |
| OWASP_MASVS.yaml | ||
| cross_references.yaml | ||
| drafts/ | ||
| Payload/ | ||
| Payload/ | ||
| .vscode/settings.json | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 3 additions & 1 deletion
4
mitigations/android-use-secure-random.md → best-practices/MASTG-BEST-0001.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 2 additions & 0 deletions
2
...ations/comply-with-privacy-regulations.md → best-practices/MASTG-BEST-0003.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| --- | ||
| title: Exclude Sensitive Data from Backups | ||
| alias: exclude-sensitive-data-from-backups | ||
| id: MASTG-BEST-0004 | ||
| platform: android | ||
| --- | ||
|
|
||
| For the sensitive files found, instruct the system to exclude them from the backup: | ||
|
|
||
| - If you are using Auto Backup, mark them with the `exclude` tag in `backup_rules.xml` (for Android 11 or lower using `android:fullBackupContent`) or `data_extraction_rules.xml` (for Android 12 and higher using `android:dataExtractionRules`), depending on the target API. Make sure to use both the `cloud-backup` and `device-transfer` parameters. | ||
| - If you are using the key-value approach, set up your [BackupAgent](https://developer.android.com/identity/data/keyvaluebackup#BackupAgent) accordingly. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| title: Use Secure Encryption Modes | ||
| alias: use-secure-encryption-modes | ||
| id: MASTG-BEST-0005 | ||
| platform: android | ||
| --- | ||
|
|
||
| Replace insecure encryption modes with secure block cipher modes such as [AES-GCM or AES-CCM](https://csrc.nist.gov/pubs/sp/800/38/d/final) which are authenticated encryption modes that provide confidentiality, integrity, and authenticity. | ||
|
|
||
| We recommend avoiding CBC, which while being more secure than ECB, improper implementation, especially incorrect padding, can lead to vulnerabilities such as padding oracle attacks. | ||
|
|
||
| For comprehensive guidance on implementing secure encryption modes in Android, refer to the official Android Developers documentation on [Cryptography](https://developer.android.com/privacy-and-security/cryptography). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| title: Use Up-to-Date APK Signing Schemes | ||
| alias: use-up-to-date-apk-signing-schemes | ||
| id: MASTG-BEST-0006 | ||
| platform: android | ||
| --- | ||
|
|
||
| Ensure that the app is signed with at least the v2 or v3 APK signing scheme, as these provide comprehensive integrity checks and protect the entire APK from tampering. For optimal security and compatibility, consider using v3, which also supports key rotation. | ||
|
|
||
| Optionally, you can add v4 signing to enable faster [incremental updates](https://developer.android.com/about/versions/11/features#incremental) in Android 11 and above, but v4 alone does not provide security protections and should be used alongside v2 or v3. | ||
|
|
||
| The signing configuration can be managed through Android Studio or the `signingConfigs` section in `build.gradle` or `build.gradle.kts`. To activate both the v3 and v4 schemes, the following values must be set: | ||
|
|
||
| ```default | ||
| // build.gradle | ||
| android { | ||
| ... | ||
| signingConfigs { | ||
| config { | ||
| ... | ||
| enableV3Signing true | ||
| enableV4Signing true | ||
| } | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| --- | ||
| title: Debuggable Flag Disabled in the AndroidManifest | ||
| alias: debuggable-flag-disabled | ||
| id: MASTG-BEST-0007 | ||
| platform: android | ||
| --- | ||
|
|
||
| Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds. | ||
|
|
||
| **Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| --- | ||
| title: Debugging Disabled for WebViews | ||
| alias: debugging-disabled-webviews | ||
| id: MASTG-BEST-0008 | ||
| platform: android | ||
| --- | ||
|
|
||
| Ensure that WebView debugging is disabled in production builds to prevent attackers from exploiting this feature to eavesdrop, modify, or debug communication within WebViews. | ||
|
|
||
| - Set `WebView.setWebContentsDebuggingEnabled` to `false` in production, or remove the calls entirely if they are unnecessary. | ||
| - If WebView debugging is required during development, ensure it is enabled only when the app is in a debuggable state by [checking the `ApplicationInfo.FLAG_DEBUGGABLE` flag at runtime](https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging). | ||
|
|
||
| For example: | ||
|
|
||
| ```kotlin | ||
| if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) { | ||
| if (0 != (getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE)) | ||
| { WebView.setWebContentsDebuggingEnabled(true); } | ||
| } | ||
| ``` | ||
|
|
||
| **Note:** Disabling WebView debugging this way helps protect an app already running on a device. For an attacker to exploit WebView debugging, they must have physical access to the device (e.g., a stolen or test device) or remote access through malware or other malicious means. Additionally, the device must typically be unlocked, and the attacker would need to know the device PIN, password, or biometric authentication to gain full control and connect debugging tools like `adb` or Chrome DevTools. | ||
|
|
||
| However, disabling WebView debugging does not eliminate all attack vectors. An attacker could: | ||
|
|
||
| 1. Patch the app to add calls to these APIs (see @MASTG-TECH-0038), then repackage and re-sign it (see @MASTG-TECH-0039). | ||
| 2. Use runtime method hooking (see @MASTG-TECH-0043) to enable WebView debugging dynamically at runtime. | ||
|
|
||
| Disabling WebView debugging serves as one layer of defense to reduce risks but should be combined with other security measures. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| --- | ||
| hide: toc | ||
| title: Best Practices (v2 Beta) | ||
| status: new | ||
| --- | ||
|
|
||
| ??? info "About the MASTG Best Practices" | ||
|
|
||
| The MASTG Best Practices are a collection of specific strategies and practices that can be used to prevent or mitigate security and privacy risks in mobile apps. | ||
|
|
||
| Each Best Practices is designed to be simple and focused and may apply to one or multiple tests in the MASTG. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| --- | ||
| hide: toc | ||
| title: MASTG Demos | ||
| title: MASTG Demos (v2 Beta) | ||
| status: new | ||
| --- | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,22 @@ | ||
| !printf "\n\n" | ||
| ?e;?e | ||
|
|
||
| !printf "Uses of SecKeyCreateRandomKey:\n" | ||
| ?e Uses of SecKeyCreateRandomKey: | ||
| afl~SecKeyCreateRandomKey | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to SecKeyCreateRandomKey:\n" | ||
| ?e xrefs to SecKeyCreateRandomKey: | ||
| axt @ 0x1000078ac | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of reloc.kSecAttrKeySizeInBits as input for SecKeyCreateRandomKey:\n" | ||
| ?e Use of reloc.kSecAttrKeySizeInBits as input for SecKeyCreateRandomKey: | ||
| pd 1 @ sym.func.1000046f8 | ||
|
|
||
| !printf "...\n" | ||
| ?e ... | ||
|
|
||
| pd 9 @ 0x10000484c | ||
|
|
||
| !printf "...\n" | ||
| ?e ... | ||
|
|
||
| pd-- 2 @ 0x1000049a0 | ||
|
|
12 changes: 6 additions & 6 deletions
12
demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/sec_hardcoded_rsa.r2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,17 @@ | ||
| e asm.bytes = false | ||
| e asm.bytes=false | ||
| e scr.color=false | ||
| e asm.var=false | ||
|
|
||
| !printf "Uses of SecKeyCreateWithData:\n" | ||
| ?e Uses of SecKeyCreateWithData: | ||
| afl~SecKeyCreateWithData | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to SecKeyCreateWithData:\n" | ||
| ?e xrefs to SecKeyCreateWithData: | ||
| axt @ 0x100007904 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| pdf @ sym.func.10000491c > function.asm | ||
|
|
||
| px 607 @ 0x1000100c8 > key.asm | ||
| px 607 @ 0x1000100c8 > key.asm |
14 changes: 7 additions & 7 deletions
14
demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/cryptokit_hardcoded_ecdsa.r2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,21 @@ | ||
| e asm.bytes = false | ||
| e asm.bytes=false | ||
| e scr.color=false | ||
| e asm.var=false | ||
|
|
||
| !printf "Uses of CryptoKit.P256.Signing.PrivateKey:\n" | ||
| ?e Uses of CryptoKit.P256.Signing.PrivateKey: | ||
| afl~CryptoKit.P256.Signing.PrivateKey | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to CryptoKit.P256.Signing.PrivateKey.rawRepresentation:\n" | ||
| ?e xrefs to CryptoKit.P256.Signing.PrivateKey.rawRepresentation: | ||
| axt @ 0x100007388 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of CryptoKit.P256.Signing.PrivateKey.rawRepresentation:\n" | ||
| ?e Use of CryptoKit.P256.Signing.PrivateKey.rawRepresentation: | ||
|
|
||
| pd-- 9 @ 0x1000048d4 | ||
|
|
||
| pdf @ sym.func.1000046dc > function.asm | ||
|
|
||
| px 32 @ 0x1000100c8 > key.asm | ||
| px 32 @ 0x1000100c8 > key.asm |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,22 @@ | ||
| !printf "\n\n" | ||
| ?e;?e | ||
|
|
||
| !printf "Uses of CommonCrypto hash function:\n" | ||
| ?e Uses of CommonCrypto hash function: | ||
| afl~CC_ | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to CC_MD5:\n" | ||
| ?e xrefs to CC_MD5: | ||
| axt @ 0x1000071a8 | ||
|
|
||
| !printf "xrefs to CC_SHA1:\n" | ||
| ?e xrefs to CC_SHA1: | ||
| axt @ 0x1000071b4 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of MD5:\n" | ||
| ?e Use of MD5: | ||
| pd-- 5 @ 0x1000048c4 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of SHA1:\n" | ||
| ?e Use of SHA1: | ||
| pd-- 5 @ 0x10000456c |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,24 @@ | ||
| !printf "\n\n" | ||
| ?e;?e | ||
|
|
||
| !printf "Uses of CryptoKit.Insecure functions:\n" | ||
| ?e Uses of CryptoKit.Insecure functions: | ||
| afl~Insecure. | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to CryptoKit.Insecure.MD5:\n" | ||
| ?e xrefs to CryptoKit.Insecure.MD5: | ||
| axt @ 0x100007280 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "xrefs to CryptoKit.Insecure.SHA1:\n" | ||
| ?e xrefs to CryptoKit.Insecure.SHA1: | ||
| axt @ 0x10000728c | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of MD5:\n" | ||
| ?e Use of MD5: | ||
| pd-- 5 @ 0x1000046d8 | ||
|
|
||
| !printf "\n" | ||
| ?e | ||
|
|
||
| !printf "Use of SHA1:\n" | ||
| ?e Use of SHA1: | ||
| pd-- 5 @ 0x100004214 |
Oops, something went wrong.