계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

312 개 항목 찾음

취약점

Android Bad Practices: Missing Receiver Permission

Java/JSP

Abstract

프로그램은 수신자 권한을 지정하지 않고 브로드캐스트를 보냅니다.

Explanation

수신자 권한 없이 보낸 브로드캐스트는 임의의 수신자에 접근할 수 없습니다. 이러한 브로드캐스트가 민감한 데이터를 포함하거나 악성 수신자에 도달하는 경우, 응용 프로그램에 위험을 끼칠 수 있습니다.

예제 1: 다음 코드는 수신자 권한을 지정하지 않고 브로드캐스트를 보냅니다.


...
context.sendBroadcast(intent);
...

References

[1] Using Permissions

[2] Jesse Burns Developing Secure Mobile Applications for Android

[3] William Enck, Machigar Ongtang, and Patrick McDaniel Understanding Android Security

[4] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[5] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 265, CWE ID 925, CWE ID 926

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[11] Standards Mapping - FIPS200 AC

[12] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[15] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[16] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3), 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3)

[21] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[22] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[23] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.6, Requirement 7.1.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control

[35] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[36] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[58] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

desc.semantic.java.android_bad_practices_missing_receiver_permission

Android Bad Practices: Mixed Component Functionality

Java/JSP

Abstract

이 수신자 구성 요소가 시스템의 메시지는 물론 다른 구성 요소의 메시지도 수신하도록 등록됩니다.

Explanation

시스템 브로드캐스트를 비공개 구성 요소로 보낼 수 있습니다. 타사로부터 비시스템 브로드캐스트를 수신하려면 구성 요소를 공개해야 합니다. 단일 구성 요소에서 시스템 브로드캐스트와 비시스템 브로드캐스트를 모두 수신하도록 등록하면 구성 요소의 일부 기능(시스템 부분)이 불필요하게 타사에 노출됩니다.

References

[1] E. Chin, A. P. Felt, K. Greenwood, and D. Wagner Analyzing Inter-Application Communication in Android

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[3] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[7] Standards Mapping - Common Weakness Enumeration CWE ID 265

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[9] Standards Mapping - FIPS200 AC

[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[18] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3)

[19] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[20] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[21] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control

[32] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[33] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[34] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.2 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.2 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.2 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.2 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.2 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.2 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.2 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

desc.configuration.java.android_bad_practices_mixed_component_functionality

Android Bad Practices: normal Permission

Java/JSP

Abstract

이 프로그램은 normal 보호 수준으로 권한을 선언합니다.

Explanation

사용자 지정 권한을 선언할 때는 4가지 옵션을 사용하여 권한의 보호 수준을 지정할 수 있습니다. 즉, normal, dangerous, signature 및 signature or system입니다. Normal 권한은 권한을 요청하는 모든 응용 프로그램에 부여됩니다. Dangerous 권한은 사용자 확인 후에만 부여됩니다. Signature 권한은 권한을 정의하는 패키지와 동일한 개발자 키로 서명된 응용 프로그램에만 부여됩니다. Signature or system 권한은 signature 권한과 유사하지만 Android 시스템 이미지의 패키지에도 부여됩니다.

예제 1: 다음은 normal 보호 수준으로 선언된 사용자 지정 권한의 예입니다.

 <permission android:name="custom.PERMISSION"
                     android:label="@string/label_permission"
                     android:description="@string/desc_permission"
                     android:protectionLevel="normal">
      </permission>

References

[1] Permission Element

[2] Security tips - Use permissions

[3] Jesse Burns Developing Secure Mobile Applications for Android

[4] William Enck, Machigar Ongtang, and Patrick McDaniel Understanding Android Security

[5] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[6] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[7] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[8] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[9] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[10] Standards Mapping - Common Weakness Enumeration CWE ID 265

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[12] Standards Mapping - FIPS200 AC

[13] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[16] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[17] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[21] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[22] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[23] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control

[34] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[35] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[36] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[50] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.java.android_bad_practices_normal_permission

Android Bad Practices: Provider Permission Defined

Java/JSP

Abstract

이 프로그램은 결합된 읽기 및 쓰기 액세스 permission으로 콘텐트 공급자를 선언합니다.

Explanation

결합된 읽기 및 쓰기 permission으로 선언된 콘텐트 공급자는 공급자에 대한 읽기 또는 쓰기 액세스를 요청하는 엔터티에 액세스할 수 있게 됩니다. 그러나 대부분의 경우 파일 시스템의 파일과 마찬가지로 공급자가 저장한 데이터에 대한 읽기 액세스 권한을 필요로 하는 엔터티는 데이터를 수정할 수 없어야 합니다. permission 속성을 설정해도 데이터의 무결성에 영향을 미치는 데이터 사용자와 상호 작용을 구분할 수는 없습니다.

예제 1: 다음은 결합된 읽기 및 쓰기 접근 permission으로 선언된 콘텐트 공급자의 예입니다.

 <provider android:name=".ContentProvider" android:permission="content.permission.READ_AND_WRITE_CONTENT"/>

References

[1] Provider Element

[2] Path Permission Element

[3] Security tips - Use permissions

[4] Jesse Burns Developing Secure Mobile Applications for Android

[5] William Enck, Machigar Ongtang, and Patrick McDaniel Understanding Android Security

[6] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[7] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[8] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[9] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[10] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[11] Standards Mapping - Common Weakness Enumeration CWE ID 265

[12] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[13] Standards Mapping - FIPS200 AC

[14] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[15] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[16] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[17] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[18] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[21] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[22] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.14.5 Configuration Architectural Requirements (L2 L3)

[23] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[24] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[25] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 7.1.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 7.1.2

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 7.1.2

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 7.1.2

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 7.1.2

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 7.2.2

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control

[36] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[37] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[38] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.2 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.2 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.2 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.2 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.2 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.2 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.2 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

desc.config.java.android_bad_practices_provider_permission_defined

Android Bad Practices: Sticky Broadcast

Java/JSP

Abstract

프로그램은 스티키 브로드캐스트(sticky broadcast)를 보냅니다.

Explanation

스티키 브로드캐스트는 권한을 사용하여 보안이 유지될 수 없어 임의의 수신자에 접근할 수 있습니다. 이러한 브로드캐스트가 민감한 데이터를 포함하거나 악성 수신자에 도달하는 경우, 응용 프로그램에 위험을 끼칠 수 있습니다.

예제 1: 다음 코드는 스티키 브로드캐스트(sticky broadcast)를 보냅니다.


...
context.sendStickyBroadcast(intent);
...

References

[1] Using Permissions

[2] Jesse Burns Developing Secure Mobile Applications for Android

[3] William Enck, Machigar Ongtang, and Patrick McDaniel Understanding Android Security

[4] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[5] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 265