Executive Summary

During the engagement, a total of 3 findings were identified against com.acmepay.app (Android): 1 high, 1 medium and 1 low.

The most significant issue is Hardcoded AWS credentials in native library (High, CVSS 7.1), which should be remediated as a priority.

The overall risk is assessed as High. Remediation of the high-severity findings should be scheduled promptly.

Detailed technical findings, evidence, and remediation guidance are provided in the following sections. All testing was performed with appropriate authorization.

Severity Breakdown

SeverityCountCVSS Range
Critical09.0 – 10.0
High17.0 – 8.9
Medium14.0 – 6.9
Low10.1 – 3.9
Info00.0

Scope & Methodology

In-Scope

Out of Scope

Testing Checklist

StepStatus
Static analysis (manifest/plist, binary protections, permissions)Complete
Insecure data storage review (local DB, logs, backups, keystore)Complete
Insecure communication review (TLS, ATS/NSC, certificate pinning)Complete
Authentication & session handling (local & remote)Complete
Authorization & access control on device resourcesComplete
Input validation (deep links, intents, WebViews, IPC)Complete
Cryptography review (weak algorithms, key management)Complete
Binary protections (tampering, debugger, repackaging, obfuscation)Complete
Supply chain review (SDKs, third-party libraries, dependencies)Pending
Privacy controls review (data collection, consent, third-party sharing)Pending
Dynamic / runtime testing (traffic interception, hooking)Pending
Retesting of confirmed findingsPending

Findings Summary

IDTitleSeverityCVSSStatus
F-001Hardcoded AWS credentials in native libraryHigh7.1open
F-002Insecure data storage — plaintext session token in SharedPreferencesMedium4.4open
F-003Certificate pinning not implementedLow4.3open

Detailed Findings

F-001 — Hardcoded AWS credentials in native library High

Category: M10:2024 — Insufficient CryptographyCVSS: 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NStatus: open

Platform

Android

App Version / Build

v3.2.1 (build 88)

Package / Bundle ID

com.acmepay.app

Component / Screen

libacmepay.so

Description

Plaintext AWS access key and secret were extracted from libacmepay.so during static analysis.

Evidence / Proof of Concept

strings libacmepay.so | grep AKIA — AKIAIOSFODNN7EXAMPLE / wJalrXUtnFEMI…

Impact

Compromise of the cloud account, data exposure, and resource abuse.

Remediation

Remove embedded secrets; move to a backend-mediated credential service; rotate the exposed keys immediately.

F-002 — Insecure data storage — plaintext session token in SharedPreferences Medium

Category: M9:2024 — Insecure Data StorageCVSS: 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NStatus: open

Platform

Android

App Version / Build

v3.2.1 (build 88)

Package / Bundle ID

com.acmepay.app

Component / Screen

SharedPreferences/session.xml

Description

The app stores the OAuth refresh token in world-readable SharedPreferences without encryption.

Evidence / Proof of Concept

adb shell run-as com.acmepay.app cat shared_prefs/session.xml — token in plaintext.

Impact

Token theft on rooted devices or via backup extraction enables account takeover.

Remediation

Store tokens in Android Keystore with hardware-backed encryption; disable backups for sensitive data.

F-003 — Certificate pinning not implemented Low

Category: M5:2024 — Insecure CommunicationCVSS: 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NStatus: open

Platform

Android

App Version / Build

v3.2.1 (build 88)

Package / Bundle ID

com.acmepay.app

Component / Screen

Network security config

Description

No certificate pinning in OkHttp/TrustKit; the app accepts any CA-issued certificate for api.acmepay.example.

Evidence / Proof of Concept

Mitmproxy successfully intercepted TLS traffic with a custom CA on a test device.

Impact

Man-in-the-middle interception of API traffic on untrusted networks.

Remediation

Implement certificate pinning for production endpoints with a rotation strategy.

Conclusion & Recommendations

The engagement identified 3 finding(s). Findings should be tracked to closure with defined owners and target dates. High and critical findings should be remediated before the application is exposed to untrusted users.