Real Dress Up - AWS Credentials, Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

Name

Vendor

Link

Store

Version

• MEDIUM
WebView files access

Control of WebView context allows to access local files.

WebView JavaScript enabled

WebView 'setJavaScriptEnabled(true)' could be exploited during cross-site scripting attacks.

SD-card access

SD-cards and other external storages have 'worldwide read' policy.

Dynamic Code Loading

Code for 'DexClassLoader' could be tampered.

• NOTICE
Possible privilege escalation

This app is looking for root tools.

External URLs

Where do they point?

Suspicious files

Are you sure these files should be here?

Unsafe deleting

All items deleted with 'file.delete()' could be recovered.

• CRITICAL
AWS Credentials

Everyone can use it to access your resources.

Dangerous filesystem permissions

Files created with these methods could be worldwide readable.

Insecure KeyStore

The app uses Android KeyStore subsystem with hardcoded authentication.

References