Swift : Weak random number generator

The pseudorandom number generator (PRNG) used in the example is not secure since it generates predictable sequences. This can be exploited to bypass authentication and hijack the user’s session, as well as to carry out the DNS cache poisoning attack.

PRNGs generate number sequences based on the initial value of the seed. There are two types of PRNG: statistical and cryptographic. Statistical PRNGs generate predictable sequences, which are similar to random according to the statistical characteristics. They should not be used for security purposes. The result of the cryptographic PRNG, on the contrary, is impossible to predict if the seed value is derived from a source with high entropy. The value of the current time has a small entropy and is also insecure as a seed.

Insufficient Cryptography vulnerabilities take the fifth place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.