Skip to content

Commit 22caac9

Browse files
gand3lfgand3lf
authored
Merge pull request #15 from mindedsecurity/development
Merge with Development
2 parents 8b3a9d7 + a622845 commit 22caac9

7 files changed

+812
-7
lines changed

‎LICENSE

Lines changed: 674 additions & 0 deletions
Large diffs are not rendered by default.

‎README.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
# Semgrep Rules for Android Application Security
22

33
[![Owasp-MASTG](https://img.shields.io/badge/OWASP_MASTG-v1.5.0-blue)](https://github.com/OWASP/owasp-mastg/tree/v1.5.0)
4-
[![Semgrep](https://img.shields.io/badge/Semgrep-v1.27.0-green)](https://semgrep.dev/)
5-
[![License](https://img.shields.io/badge/License-GPL3.0-orange)](https://www.gnu.org/licenses/gpl-3.0.html)
4+
[![Semgrep](https://img.shields.io/badge/Semgrep-v1.55.0-orange)](https://semgrep.dev/)
65

76
This project is a compilation of [Semgrep](https://semgrep.dev/) rules derived from the OWASP Mobile Application Security Testing Guide ([MASTG](https://mas.owasp.org/MASTG/)) specifically for Android applications.
87
The aim is to enhance and support Mobile Application Penetration Testing (MAPT) activities conducted by the ethical hacker community.
@@ -40,7 +39,7 @@ Performance tips:
4039
4140
>_2. Make sure to launch the scan from the project folder in order to use the provided ".semgrepignore" file. This prevents scanning well-known libraries that could generate a high number of false positives._
4241
43-
### Project Status
42+
### Project Status :checkered_flag:
4443
The rules are aligned with the version [1.5.0](https://github.com/OWASP/owasp-mastg/tree/v1.5.0) of the OWASP MASTG. While complete coverage of all tests cannot be guaranteed, the authors have made significant efforts to provide a comprehensive overview of the status of each implemented rule.
4544
The presence of False Positives (FP) is expected but limited and efforts have been done to reduce the potential occurrence of False Negatives (FN).
4645

@@ -63,7 +62,11 @@ Moreover, the rules that requires a specific knowledge of the application contex
6362
### Authors & Contributors :beers: :it:
6463
The project was started in March 2023 by the [**IMQ Minded Security**](https://mindedsecurity.com/) team with the purpose to contribute to the ethical hacking and mobile development communities. The company has an ongoing commitment to make customers aware of cyber risks supporting businesses and organizations to build secure products and services.
6564
The contribution to this project is totally open with the recommendation to be careful in submitting rules that respect the proposed format.
66-
- Supervisor: Stefano Di Paola (@WisecWisec)
67-
- Project leader: Riccardo Cardelli (@gand3lf)
68-
- Contributors: Andrea Agnello, Christian Cotignola (@b4dsheep), Federico Dotta (@apps3c), Giacomo Zorzin (@gellge), Giovanni Fazi (@giovifazi), Martino Lessio (@mlessio), Maurizio Siddu (@akabe1), Michele Di Bonaventura (@cyberaz0r), Michele Tumolo (@zer0s0urce), Riccardo Granata
65+
- Supervisor: Stefano Di Paola ([@WisecWisec](https://twitter.com/WisecWisec))
66+
- Project leader: Riccardo Cardelli ([@gand3lf](https://github.com/gand3lf))
67+
- Contributors: Andrea Agnello (@AndreNoli), Christian Cotignola (@b4dsheep), Federico Dotta (@apps3c), Giacomo Zorzin (@gellge), Giovanni Fazi (@giovifazi), Martino Lessio (@mlessio), Maurizio Siddu (@akabe1), Michele Di Bonaventura (@cyberaz0r), Michele Tumolo (@zer0s0urce), Riccardo Granata (@riccardogranata)
6968

69+
### Talks & More :microphone:
70+
- 23 Oct 2023: IMQ Minded Security Blog ([Project's Official Article](https://blog.mindedsecurity.com/2023/10/semgrep-rules-for-android-application.html))
71+
- 11 Sep 2023: OWASP Italy Day ([Slides](https://github.com/OWASP/www-chapter-italy/blob/96201991fdfef280a67d3b41b85e7715d53115d8/assets/images/Riccardo%20Cardelli%20-%20OWASP%20Italy%20Day%202023%20-%2011th%20Sept%20PoliMi.pdf))
72+
- 03 Ago 2023: DevSecCon - Introduzione a SAST e Mobile Security Testing ([YouTube Live](https://youtu.be/ZsZMzGD9-6E))

‎rules/network/mstg-network-1.1.xml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:versionCode="1" android:versionName="1.0" package="com.mindedsecurity.secureandroid" platformBuildVersionCode="1" platformBuildVersionName="1">
3+
<!-- ruleid: MSTG-NETWORK-1.1 -->
4+
<uses-sdk android:minSdkVersion="29" android:targetSdkVersion="11"/>
5+
<uses-permission android:name="android.permission.INTERNET"/>
6+
<permission android:name="com.mindedsecurity.secureandroid.VIEW_CREDENTIALS" android:protectionLevel="signature"/>
7+
<application android:theme="@style/AppTheme" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:debuggable="true" android:allowBackup="true" android:supportsRtl="true" android:networkSecurityConfig="@xml/network_security_config">
8+
<activity android:name="com.mindedsecurity.secureandroid.MainActivity">
9+
<intent-filter>
10+
<action android:name="android.intent.action.MAIN"/>
11+
<category android:name="android.intent.category.LAUNCHER"/>
12+
</intent-filter>
13+
</activity>
14+
<activity android:name="com.mindedsecurity.secureandroid.RootCheckActivity"/>
15+
<activity android:name="com.mindedsecurity.secureandroid.EmulatorCheckActivity"/>
16+
<activity android:name="com.mindedsecurity.secureandroid.InstallationCheckActivity"/>
17+
<activity android:name="com.mindedsecurity.secureandroid.SignatureCheckActivity"/>
18+
<activity android:name="com.mindedsecurity.secureandroid.DisablingScreenshotActivity"/>
19+
<activity android:name="com.mindedsecurity.secureandroid.DisablingClipboardActivity"/>
20+
<activity android:name="com.mindedsecurity.secureandroid.KeychainActivity"/>
21+
<activity android:name="com.mindedsecurity.secureandroid.SQLIteActivity"/>
22+
<activity android:name="com.mindedsecurity.secureandroid.FileStorageActivity"/>
23+
<activity android:name="com.mindedsecurity.secureandroid.URIValidationActivity"/>
24+
<activity android:name="com.mindedsecurity.secureandroid.CredentialsActivity" android:permission="com.mindedsecurity.secureandroid.VIEW_CREDENTIALS" android:exported="true"/>
25+
<activity android:name="com.mindedsecurity.secureandroid.CustomPermissionsActivity"/>
26+
<activity android:name="com.mindedsecurity.secureandroid.SecureCommunicationActivity"/>
27+
</application>
28+
</manifest>

‎rules/network/mstg-network-1.1.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
rules:
2+
- id: MSTG-NETWORK-1.1
3+
severity: WARNING
4+
languages:
5+
- xml
6+
metadata:
7+
authors:
8+
- Andrea Agnello (IMQ Minded Security)
9+
- Riccardo Granata (IMQ Minded Security)
10+
owasp-mobile: M1
11+
category: security
12+
area: storage
13+
verification-level:
14+
- L1
15+
- L2
16+
references:
17+
- https://github.com/OWASP/owasp-mastg/blob/v1.5.0/Document/0x05g-Testing-Network-Communication.md#testing-data-encryption-on-the-network-mstg-network-1
18+
message: The application transmits information over insecure channels through the use of HttpURLConnection. It is recommended to verify if the Network Security Configuration is appropriately configured to prevent such insecure transmissions.
19+
paths:
20+
include:
21+
- "**/AndroidManifest.xml"
22+
pattern-either:
23+
- patterns:
24+
- pattern: <uses-sdk ... android:targetSdkVersion="$VE" .../>
25+
- metavariable-comparison:
26+
comparison: int($VE) < 28
27+
metavariable: $VE
28+
- patterns:
29+
- pattern: <application ... android:usesCleartextTraffic="true" ... />

‎rules/network/mstg-network-1.2.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// ruleid: MSTG-NETWORK-1.1
2+
3+
import javax.net.ssl.SSLSocket;
4+
import javax.net.ssl.SSLSession;
5+
import java.io.IOException;
6+
import java.net.InetSocketAddress;
7+
8+
public class SSLSocketExample {
9+
10+
public static void main(String[] args) throws IOException {
11+
SSLSocket sslSocket = createSSLSocket("example.com", 443);
12+
SSLSession sslSession = sslSocket.getSession();
13+
String hostname = sslSession.getPeerHost();
14+
sslSocket.close();
15+
}
16+
17+
private static SSLSocket createSSLSocket(String host, int port) throws IOException {
18+
SSLSocket sslSocket = (SSLSocket) SSLSocketFactory.getDefault().createSocket();
19+
sslSocket.connect(new InetSocketAddress(host, port));
20+
return sslSocket;
21+
}
22+
}

‎rules/network/mstg-network-1.2.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
rules:
2+
- id: MSTG-NETWORK-1.2
3+
severity: WARNING
4+
languages:
5+
- java
6+
metadata:
7+
authors:
8+
- Riccardo Granata (IMQ Minded Security)
9+
- Andrea Agnello (IMQ Minded Security)
10+
owasp-mobile: M1
11+
category: security
12+
area: storage
13+
verification-level:
14+
- L1
15+
- L2
16+
references:
17+
- https://github.com/OWASP/owasp-mastg/blob/v1.5.0/Document/0x05g-Testing-Network-Communication.md#testing-data-encryption-on-the-network-mstg-network-1
18+
message: The application could send information over insecure channels or not use the getDefaultHostnameVerifier method for SSLSocket
19+
paths:
20+
exclude:
21+
- "**/okhttp3/**"
22+
- "**/volley/**"
23+
- "**/okio/**"
24+
- "**/retrofit2/**"
25+
- "**/Ion/**"
26+
- "**/asynchttpclient/**"
27+
- "**/fuel/**"
28+
- "**/android-async-http/**"
29+
pattern-either:
30+
- patterns:
31+
- pattern-inside: |
32+
$METHOD(...){...}
33+
- pattern: Socket $SOCKET = new Socket(...);
34+
- patterns:
35+
- pattern-inside: |
36+
$METHOD(...){...}
37+
- pattern: $CONNECTION = (HttpURLConnection) $URI.openConnection();
38+
- patterns:
39+
- pattern-either:
40+
- patterns:
41+
- pattern-inside: |
42+
import java.net.Socket;
43+
...
44+
- pattern-not-regex: .*\.getDefaultHostnameVerifier().*
45+
- patterns:
46+
- pattern-inside: |
47+
import javax.net.ssl.SSLSocket;
48+
...
49+
- pattern-not-regex: .*\.getDefaultHostnameVerifier().*

‎status.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ The grade of maturity and the reliability of each rule has been classified accor
3333
| MSTG-CRYPTO-6 | All random values are generated using a sufficiently secure random number generator. | L1 | Partial | :broken_heart:|
3434
| MSTG-AUTH-1 | If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint. | L1 | Infeasible | :x:|
3535
| MSTG-AUTH-8 | Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns "true" or "false"). Instead, it is based on unlocking the keychain/keystore. | L2 | Good | :thumbsup:|
36-
| MSTG-NETWORK-1 | Data is encrypted on the network using TLS. The secure channel is used consistently throughout the app. | L1 | Soon... | :clock4:|
36+
| MSTG-NETWORK-1 | Data is encrypted on the network using TLS. The secure channel is used consistently throughout the app. | L1 | Partial | :broken_heart:|
3737
| MSTG-NETWORK-2 | The TLS settings are in line with current best practices, or as close as possible if the mobile operating system does not support the recommended standards. | L1 | Complete | :heavy_check_mark:|
3838
| MSTG-NETWORK-3 | The app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certificates signed by a trusted CA are accepted. | L1 | Soon... | :clock4:|
3939
| MSTG-NETWORK-4 | The app either uses its own certificate store, or pins the endpoint certificate or public key, and subsequently does not establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA. | L2 | Partial | :broken_heart:|

0 commit comments

Comments
 (0)