MASWE-0104: App Integrity Not Verified
Content in BETA
This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).
Draft Weakness
This weakness hasn't been created yet and it's in draft. But you can check its status or start working on it yourself. If the issue has not yet been assigned, you can request to be assigned to it and submit a PR with the new content for that weakness by following our guidelines.
Check our GitHub Issues for MASWE-0104
Initial Description or Hints¶
Potentially relevant for apps in alternative app stores (not Google PlayStore or Apple AppStore). Also, e.g. Android V1 signing scheme only or iOS CodeDirectory v less than 20400. Also, e.g. App Signature or Binaries, native libraries including e.g. AppAttest
Note: consider Static Code Modification? / Repackaging Detection Not Implemented
Relevant Topics¶
- App Signature or Binaries check on runtime
- native libraries including e.g. AppAttest
- Invalid App Signing Certificate
- Latest Available Signing Scheme Not Used - Android V1 signing scheme only
- Latest Available Signing Scheme Not Used - iOS CodeDirectory v less than 20400
- detection in place
- Effectiveness Assessment (e.g. bypassing the detection)