Security controls bypass or absence - Reversing Protection
Description
The application does not have anti-reverse engineering protections. Sophisticated reverse engineering tools and techniques could bypass weak security controls against reversing protection.
Impact
- Reveal cryptographic constants and ciphers.
- Steal intellectual property.
- Perform attacks against back end systems.
Recommendation
- Encrypt the executable version of the software.
- Use additional protection against reverse engineering, a combination of obfuscation techniques.
- Extend the same protection to software or firmware upgrades.
- Select automated anti-reversing techniques based on which one could provide a best fit for business security goals, performance requirements, and cost sensitivity.
Threat
Anonymous attacker performing an analysis of the final core binary to determine its source code, algorithms and resources embedded within the app to execute dubious actions.
Expected Remediation Time
⌚ 450 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: P
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: U
- Confidentiality: L
- Integrity: N
- Availability: N
Temporal
- Exploit code maturity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
- Score:
- Base: 2.4
- Temporal: 2.4
- Severity:
- Base: Low
- Temporal: Low
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: P
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X
Result 4.0
- Vector string: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
- Score:
- CVSS-BT: 2.4
- Severity:
- CVSS-BT: Low
Details
https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05j-testing-resiliency-against-reverse-engineering#owasp-masvs
Requirements
Fixes
