Config files : Empty encryption key

Empty encryption key in a configuration file can compromise the application.

It is very difficult to eliminate the security risks related to hardcoded empty keys. The fact that some data is encrypted with an empty key is at least known to every application developer. Moreover, after the application is installed, the empty key can be removed from the code only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have an access to the source code to learn about the encryption with an empty key.

Insufficient Cryptography vulnerabilities take the fifth place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.