[V17 - Mobile Controls.xlsx] Verify that App manifest file doesn't contain Dailer secret code. about asvs

[vanderaj]

These are special diagnostic features of certain Android platforms:

http://www.redmondpie.com/hidden-android-secret-codes-for-samsung-htc-motorola-sony-lg-and-other-devices/

This is a platform issue on Android, and to a lesser extent Windows phones. Check this out.

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/november/manitree-androidmanifest.xml-auditor/

The attack path is:

• On a single Google account, deploy an app to the google play store with a suitable code
• On a single device, Install the app
• On a single unlocked device, type the secret diagnostic code
• See interesting stuff

So unless the app is Angry Birds, or a core system component, it's unlikely that any nefarious behavior will occur until triggered by a user, who can also root the device, run with USB debugging and run the app under an emulator.

Please explain how someone who has unauthorized access to the phone or table would exploit this issue? Is this an issue that the ASVS should cover? Could it be covered under the malicious code L3 requirement?

For example, can you access these hidden menus from the emergency dialer whilst the phone is locked?

thanks
Andrew

[bugwrangler]

Well, let me brief you the problem ~ I wanted to make clear POV for the app manifest file design.

I was testing android mobile app for one of our banking client.

Developer has put some Dailer Android:scheme=“android_secret_code” (XXXXXX) for the APP Secrets screen E.G – Using this hidden screen, User is allowed to change API , back logs server details, Put a Master password , Back up crash logs etc.

I just wanted to make sure, Dev should know - this kind of secrets screen easily available at end users side, so this must not grant access to any sensitive information disclosure.

E.g – I have taken your phone for giving a call, now Being attacker I can change API / Put a Master password – Next story I don’t need describe what can't be done using this. This issue reproduces with real device.

Yep - App oriented secret doesn't be execute via emergency dialer.

[bugwrangler]

This should be cover in mobile control sheet, however its my individual view. We can discuss further with team and take a call where this best fit. 👍

[danielcuthbert]

I feel this is covered in the mobile control sheet too.