During the engagement, a total of 3 findings were identified against com.acmepay.app (Android): 1 high, 1 medium and 1 low.
The most significant issue is Hardcoded AWS credentials in native library (High, CVSS 7.1), which should be remediated as a priority.
The overall risk is assessed as High. Remediation of the high-severity findings should be scheduled promptly.
Detailed technical findings, evidence, and remediation guidance are provided in the following sections. All testing was performed with appropriate authorization.
| Severity | Count | CVSS Range |
|---|---|---|
| Critical | 0 | 9.0 – 10.0 |
| High | 1 | 7.0 – 8.9 |
| Medium | 1 | 4.0 – 6.9 |
| Low | 1 | 0.1 – 3.9 |
| Info | 0 | 0.0 |
| Step | Status |
|---|---|
| Static analysis (manifest/plist, binary protections, permissions) | Complete |
| Insecure data storage review (local DB, logs, backups, keystore) | Complete |
| Insecure communication review (TLS, ATS/NSC, certificate pinning) | Complete |
| Authentication & session handling (local & remote) | Complete |
| Authorization & access control on device resources | Complete |
| Input validation (deep links, intents, WebViews, IPC) | Complete |
| Cryptography review (weak algorithms, key management) | Complete |
| Binary protections (tampering, debugger, repackaging, obfuscation) | Complete |
| Supply chain review (SDKs, third-party libraries, dependencies) | Pending |
| Privacy controls review (data collection, consent, third-party sharing) | Pending |
| Dynamic / runtime testing (traffic interception, hooking) | Pending |
| Retesting of confirmed findings | Pending |
| ID | Title | Severity | CVSS | Status |
|---|---|---|---|---|
| F-001 | Hardcoded AWS credentials in native library | High | 7.1 | open |
| F-002 | Insecure data storage — plaintext session token in SharedPreferences | Medium | 4.4 | open |
| F-003 | Certificate pinning not implemented | Low | 4.3 | open |
Android
v3.2.1 (build 88)
com.acmepay.app
libacmepay.so
Plaintext AWS access key and secret were extracted from libacmepay.so during static analysis.
strings libacmepay.so | grep AKIA — AKIAIOSFODNN7EXAMPLE / wJalrXUtnFEMI…
Compromise of the cloud account, data exposure, and resource abuse.
Remove embedded secrets; move to a backend-mediated credential service; rotate the exposed keys immediately.
Android
v3.2.1 (build 88)
com.acmepay.app
SharedPreferences/session.xml
The app stores the OAuth refresh token in world-readable SharedPreferences without encryption.
adb shell run-as com.acmepay.app cat shared_prefs/session.xml — token in plaintext.
Token theft on rooted devices or via backup extraction enables account takeover.
Store tokens in Android Keystore with hardware-backed encryption; disable backups for sensitive data.
Android
v3.2.1 (build 88)
com.acmepay.app
Network security config
No certificate pinning in OkHttp/TrustKit; the app accepts any CA-issued certificate for api.acmepay.example.
Mitmproxy successfully intercepted TLS traffic with a custom CA on a test device.
Man-in-the-middle interception of API traffic on untrusted networks.
Implement certificate pinning for production endpoints with a rotation strategy.
The engagement identified 3 finding(s). Findings should be tracked to closure with defined owners and target dates. High and critical findings should be remediated before the application is exposed to untrusted users.