HackMD
CODE ANALYSIS
- The App uses an insecure Random Number Generator.
- Insecure WebView Implementation. Execution of user controlled code in WebView is a critical Security Hole.
- App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.
- App can read/write to External Storage. Any App can read data written to External Storage.
- Files may contain hardcoded sensitive information like usernames, passwords, keys etc.
- SHA-1 is a weak hash known to have hash collisions.
FILE ANALYSIS
- Certificate/Key files hardcoded inside the app.
