MASWE-0104: Integridade do Aplicativo Não Verificada
Content in BETA
This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).
Placeholder Weakness
This weakness hasn't been created yet and it's a placeholder. But you can check its status or start working on it yourself. If the issue has not yet been assigned, you can request to be assigned to it and submit a PR with the new content for that weakness by following our guidelines.
Check our GitHub Issues for MASWE-0104
Initial Description or Hints¶
O código do aplicativo não implementa técnicas eficazes para verificar a integridade do seu próprio código (CWE-347), potencialmente relevante para aplicativos em lojas alternativas (não Google PlayStore ou Apple AppStore). Além disso, por exemplo, esquema de assinatura Android V1 apenas ou iOS CodeDirectory v inferior a 20400. Também, por exemplo, Assinatura do Aplicativo ou Binários, bibliotecas nativas incluindo, por exemplo, AppAttest.
Note: consider Static Code Modification? / Repackaging Detection Not Implemented
Relevant Topics¶
- App Signature or Binaries check on runtime
- native libraries including e.g. AppAttest
- Invalid App Signing Certificate
- Latest Available Signing Scheme Not Used - Android V1 signing scheme only
- Latest Available Signing Scheme Not Used - iOS CodeDirectory v less than 20400
- detection in place
- Effectiveness Assessment (e.g. bypassing the detection)
References¶
MASTG v1 Coverage¶
No MASTG v1 tests are related to this weakness.
Tests¶
MASTG-TEST-0225: Uso de Tamanho de Chave de Assinatura Inseguro MASTG-TEST-0224: Uso de Versão de Assinatura Insegura MASTG-TEST-0220: Uso de Formato de Code Signature Desatualizado