DerScanner
Home / Vulnerability Database / Objective-C : Hardcoded encryption key
Objective-C

Objective-C : Hardcoded encryption key

Classification

OWASP Mobile Top 10 2014
M6-Broken Cryptography
OWASP Mobile Top 10 2016
M5-Insufficient Cryptography
OWASP Top 10 2021
A4-Insecure Design
OWASP MASVS
V2: 2.2.(L1/L2/L1+R/L2+R)V2: 2.14.(L2/L2+R)V3: 3.1.(L1/L2/L1+R/L2+R)V8: 8.11.(L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored CryptographyStored CryptographyStored CryptographySession ManagementAuthentication
PCI DSS 4.0
3.7.36.5.66.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-257CWE-321CWE-522CWE-798
CWE/SANS Top 25 2011
CWE-798
CWE/SANS Top 25 2021
CWE-522CWE-798

Overview

Encryption key is hardcoded. This may lead to an application data compromise.

Eliminating security risks related to hardcoded passwords or keys is extremely difficult. This data is available at least to every developer of the application. Moreover, after the application is installed, removing password or key from its code is possible only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have an access to the source code to find out the value of the key.

Insufficient Cryptography vulnerabilities take the fifth place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.

References

  1. Use of hard-coded password
  2. CWE-321: Use of Hard-coded Cryptographic Key
  3. Mobile Top 10 2014-M6-Broken Cryptography
  4. OWASP Top 10 2013-A5-Security Misconfiguration
  5. OWASP Top 10 2013-A6-Sensitive Data Exposure
  6. RNCryptor README - github.com
  7. Mobile Top 10 2016-M5-Insufficient Cryptography
  8. CWE-798: Use of Hard-coded Credentials
MEDIUM

DerScanner Severity Score

Do you want to fix Objective-C : Hardcoded encryption key in your application?

See also

Objective-C

Objective-C : Internal information leak

Objective-C

Objective-C : Weak hashing algorithm

Objective-C

Objective-C : Unsafe reflection