ANDROID STATIC ANALYSIS REPORT
BusMate (1.0)
File Name: [Link]
Package Name: [Link]
Average CVSS Score: 6.8
App Security Score: 55/100 (MEDIUM RISK)
Scan Date: Nov. 15, 2021, 12:35 p.m.
FILE INFORMATION
File Name: [Link]
Size: 3.69MB
MD5: 8a6422d5ce3dfe236c35f9e9cafe3290
SHA1: c91330bb21327eaa4c943e374aea2dc7f19f52a2
SHA256: cb7b9a113ded2b8b55ccb02b7fd14a6f67eb3d3f554d367511d0b3b5f27b6734
APP INFORMATION
App Name: BusMate
Package Name: [Link]
Main Activity: [Link]
Target SDK: 30
Min SDK: 23
Max SDK:
Android Version Name: 1.0
Android Version Code: 1
APP COMPONENTS
Activities: 11
Services: 0
Receivers: 0
Providers: 1
Exported Activities: 0
Exported Services: 0
Exported Receivers: 0
Exported Providers: 0
CERTIFICATE INFORMATION
APK is signed
v1 signature: False
v2 signature: True
v3 signature: False
Found 1 unique certificates
Subject: C=IN, ST=Delhi, L=New Delhi, O=CERT-In, OU=CSA, CN=Empanelment
Signature Algorithm: rsassa_pkcs1v15
Valid From: 2021-10-27 05:25:06+00:00
Valid To: 2521-06-28 05:25:06+00:00
Issuer: C=IN, ST=Delhi, L=New Delhi, O=CERT-In, OU=CSA, CN=Empanelment
Serial Number: 0x462d053f
Hash Algorithm: sha256
md5: b0331c646a01d342744a83a1a9dca1e1
sha1: e441b59b1a0544d89594fe42895fd67da6c27d50
sha256: 672596a8e9628c736049cf6191bad9fc3a9c77136e08210f0bd293d7f7fba5ee
sha512: 94cef95a8d6ed68c23766b5287c947c44569484cca785a8d19a37c6889afd8544957a0743c4ee5db35a8b2fa8efbf66fb7451e7fdcfd7040b95a1974023cd995
PublicKey Algorithm: rsa
Bit Size: 2048
Fingerprint: f507a98b6eed960a443a2b6de22370459c5bc08b52754507e7de219958d045a8
STATUS DESCRIPTION
secure Application is signed with a code signing certificate
APPLICATION PERMISSIONS
PERMISSION STATUS INFO DESCRIPTION
[Link].MAPS_RECEIVE unknown Unknown Unknown permission from android reference
permission
[Link].ACCESS_NETWORK_STATE normal view network Allows an application to view the status of all networks.
status
read/modify/delete
[Link].WRITE_EXTERNAL_STORAGE dangerous external storage Allows an application to write to external storage.
contents
Unknown
[Link].READ_GSERVICES unknown permission Unknown permission from android reference
PERMISSION STATUS INFO DESCRIPTION
Access coarse location sources, such as the mobile network
coarse (network- database, to determine an approximate phone location,
[Link].ACCESS_COARSE_LOCATION dangerous based) location where available. Malicious applications can use this to
determine approximately where you are.
Access fine location sources, such as the Global Positioning
[Link].ACCESS_FINE_LOCATION dangerous fine (GPS) location System on the phone, where available. Malicious
applications can use this to determine where you are and
may consume additional battery power.
[Link].WAKE_LOCK normal prevent phone Allows an application to prevent the phone from going to
from sleeping sleep.
[Link] normal full Internet access Allows an application to create network sockets.
Allows an application to read all of the contact (address)
[Link].READ_CONTACTS dangerous read contact data data stored on your phone. Malicious applications can use
this to send your data to other people.
[Link].ACCESS_WIFI_STATE normal view Wi-Fi status Allows an application to view the information about the
status of Wi-Fi.
read external
[Link].READ_EXTERNAL_STORAGE dangerous storage contents Allows an application to read from external storage.
Unknown
[Link].READ_INTERNAL_STORAGE unknown permission Unknown permission from android reference
[Link].WRITE_INTERNAL_STORAGE unknown Unknown Unknown permission from android reference
permission
Unknown
[Link].DOWNLOAD_WITHOUT_NOTIFICATION unknown permission Unknown permission from android reference
APKID ANALYSIS
FILE DETAILS
FINDINGS DETAILS
[Link] [Link] check
Anti-VM Code [Link] check
Compiler r8
NETWORK SECURITY
NO SCOPE SEVERITY DESCRIPTION
MANIFEST ANALYSIS
NO ISSUE SEVERITY DESCRIPTION
Application Data can be
1 Backed up medium This flag allows anyone to backup your application data via adb. It allows users who have enabled USB
[android:allowBackup=true] debugging to copy application data off of the device.
CODE ANALYSIS
NO ISSUE SEVERITY STANDARDS FILES
in/linus/busmate/Activity/Alert
[Link]
in/linus/busmate/Activity/Main
[Link]
in/linus/busmate/Activity/BusIn
[Link]
in/linus/busmate/Activity/Near
[Link]
in/linus/busmate/Activity/Perm
CVSS V2: 7.5 (high) [Link]
1 The App logs information. Sensitive info CWE: CWE-532 Insertion of Sensitive Information into Log in/linus/busmate/Utility/Check
information should never be logged. File [Link]
OWASP MASVS: MSTG-STORAGE-3 in/linus/busmate/Activity/Regis
[Link]
in/linus/busmate/Utility/Consta
[Link]
in/linus/busmate/Activity/Login
_Activity.java
in/linus/busmate/Activity/BusD
[Link]
in/linus/busmate/Activity/Drive
[Link]
CVSS V2: 5.5 (medium) in/linus/busmate/Activity/Alert
App can read/write to External
2 Storage. Any App can read data high CWE: CWE-276 Incorrect Default Permissions [Link]
written to External Storage. OWASP Top 10: M2: Insecure Data Storage in/linus/busmate/Utility/Consta
OWASP MASVS: MSTG-STORAGE-2 [Link]
NO ISSUE SEVERITY STANDARDS FILES
Files may contain hardcoded sensitive CVSS V2: 7.4 (high) in/linus/busmate/Activity/Near
3 information like usernames, warning CWE: CWE-312 Cleartext Storage of Sensitive Information [Link]
passwords, keys etc. OWASP Top 10: M9: Reverse Engineering in/linus/busmate/Activity/Drive
OWASP MASVS: MSTG-STORAGE-14 [Link]
App uses SQLite Database and
execute raw SQL query. Untrusted CVSS V2: 5.9 (medium)
4 user input in raw SQL queries can warning CWE: CWE-89 Improper Neutralization of Special Elements in/linus/busmate/user_sqlhelpe
cause SQL Injection. Also sensitive used in an SQL Command ('SQL Injection') [Link]
information should be encrypted and OWASP Top 10: M7: Client Code Quality
written to the database.
CVSS V2: 7.5 (high)
5 The App uses an insecure Random warning CWE: CWE-330 Use of Insufficiently Random Values in/linus/busmate/Activity/Drive
Number Generator. OWASP Top 10: M5: Insufficient Cryptography [Link]
OWASP MASVS: MSTG-CRYPTO-6
NIAP ANALYSIS v1.3
NO IDENTIFIER REQUIREMENT FEATURE DESCRIPTION
Security Functional Random Bit The application use no DRBG functionality for its cryptographic
1 FCS_RBG_EXT.1.1 Requirements Generation Services operations.
2 FCS_STO_EXT.1.1 Security Functional Storage of Credentials The application does not store any credentials to non-volatile memory.
Requirements
3 FCS_CKM_EXT.1.1 Security Functional Cryptographic Key The application generate no asymmetric cryptographic keys.
Requirements Generation Services
NO IDENTIFIER REQUIREMENT FEATURE DESCRIPTION
4 FDP_DEC_EXT.1.1 Security Functional Access to Platform The application has access to ['network connectivity', 'location'].
Requirements Resources
5 FDP_DEC_EXT.1.2 Security Functional Access to Platform The application has access to ['address book'].
Requirements Resources
6 FDP_NET_EXT.1.1 Security Functional Network The application has user/application initiated network communications.
Requirements Communications
Security Functional Encryption Of The application implement functionality to encrypt sensitive data in non-
7 FDP_DAR_EXT.1.1 Sensitive Application
Requirements Data volatile memory.
Security Functional Supported The application invoke the mechanisms recommended by the platform
8 FMT_MEC_EXT.1.1 Requirements Configuration vendor for storing and setting configuration options.
Mechanism
Security Functional Protection of Data in The application does encrypt some transmitted data with HTTPS/TLS/SSH
9 FTP_DIT_EXT.1.1 Requirements Transit between itself and another trusted IT product.
Selection-Based Security The application implement the HTTPS protocol that complies with RFC
10 FCS_HTTPS_EXT.1.1 Functional Requirements HTTPS Protocol 2818.
11 FCS_HTTPS_EXT.1.2 Selection-Based Security HTTPS Protocol The application implement HTTPS using TLS.
Functional Requirements
HARDCODED SECRETS
POSSIBLE SECRETS
"maps_api" : "AIzaSyAoLvuKnwTA3uU2kRZgt6LzgmI1nCUJAZA"
"preferences_file_key" : "UserLoginDetails"
App Security Score Calculation
Every app is given an ideal score of 100 to begin with.
For every findings with severity high we reduce 15 from the score.
For every findings with severity warning we reduce 10 from the score.
For every findings with severity good we add 5 to the score.
If the calculated score is greater than 100, then the app security score is considered as 100.
And if the calculated score is less than 0, then the app security score is considered as 10.
Risk Calculation
APP SECURITY SCORE RISK
0 - 15 CRITICAL
16 - 40 HIGH
41 - 70 MEDIUM
71 - 100 LOW
Report Generated by - MobSF v3.4.5 Beta
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment
framework capable of performing static and dynamic analysis.
© 2021 Mobile Security Framework - MobSF | Ajin Abraham | OpenSecurity.