MASWE-0104: App Integrity Not Verified

Content in BETA

This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).

Send Feedback

Draft Weakness

This weakness hasn't been created yet and it's in draft. But you can check its status or start working on it yourself. If the issue has not yet been assigned, you can request to be assigned to it and submit a PR with the new content for that weakness by following our guidelines.

Check our GitHub Issues for MASWE-0104

Initial Description or Hints

Potentially relevant for apps in alternative app stores (not Google PlayStore or Apple AppStore). Also, e.g. Android V1 signing scheme only or iOS CodeDirectory v less than 20400. Also, e.g. App Signature or Binaries, native libraries including e.g. AppAttest

Note: consider Static Code Modification? / Repackaging Detection Not Implemented

Relevant Topics

• App Signature or Binaries check on runtime
• native libraries including e.g. AppAttest
• Invalid App Signing Certificate
• Latest Available Signing Scheme Not Used - Android V1 signing scheme only
• Latest Available Signing Scheme Not Used - iOS CodeDirectory v less than 20400
• detection in place
• Effectiveness Assessment (e.g. bypassing the detection)

References

• https://developer.apple.com/documentation/xcode/using-the-latest-code-signature-format

MASTG v1 Coverage

• MASTG-TEST-0081 - Making Sure that the App Is Properly Signed (ios)
• MASTG-TEST-0038 - Making Sure that the App is Properly Signed (android)

Tests

MASTG-TEST-0220: Usage of Outdated Code Signature Format MASTG-TEST-0225: Usage of Insecure Signature Key Size MASTG-TEST-0224: Usage of Insecure Signature Version