Security issues with Android APP
Budget: $30 – $250 USD
We need support to resolve some penetration points raised by information security for hybrid mobile applications using Expo & React-Native as front-end and back-end Web API is in C#
the issues raised are for Android
1-Application uses hashing algorithms that are known to consist of possible collisions (such as SHA-1 and MD5).
Security Recommendations: It is recommended to be using safer/stronger hashing alternatives, such as SHA-256, SHA-512, SHA-3, etc.
We are able to find these references in the application references but these references are related to Expo packages and can’t be changed.
2-Application uses Cipher Block Chaining (CBC) as it’s encryption mode, along with Public Key Cryptography Standards (PKCS5/PKCS7) padding. This configuration is known to be vulnerable to Padding Oracle attacks.
Security Recommendations: Encryption operation mode and the padding scheme should be chosen appropriately to guarantee data confidentiality, integrity and authenticity.
We tried to find out these Cipher in the application but unable to find any keywords with “Cipher.getInstance”
Hence please dont accept the job unless you know the sloution
the issues raised are for Android
1-Application uses hashing algorithms that are known to consist of possible collisions (such as SHA-1 and MD5).
Security Recommendations: It is recommended to be using safer/stronger hashing alternatives, such as SHA-256, SHA-512, SHA-3, etc.
We are able to find these references in the application references but these references are related to Expo packages and can’t be changed.
2-Application uses Cipher Block Chaining (CBC) as it’s encryption mode, along with Public Key Cryptography Standards (PKCS5/PKCS7) padding. This configuration is known to be vulnerable to Padding Oracle attacks.
Security Recommendations: Encryption operation mode and the padding scheme should be chosen appropriately to guarantee data confidentiality, integrity and authenticity.
We tried to find out these Cipher in the application but unable to find any keywords with “Cipher.getInstance”
Hence please dont accept the job unless you know the sloution