Websea Exchange

When installing the Android application and analyzing the AndroidManifest.xml file, it was found that the application requests access to more permissions than what was expected. Specifically, the application requests the following unnecessary/dangerous permissions: ```xml <uses-permission android:name="android.permission.REORDER_TASKS" /> <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" /> <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.VIBRATE" /> <uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" /> <uses-permission android:name="android.permission.CAMERA" /> <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" /> <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" /> <uses-permission android:name="android.permission.FLASHLIGHT" /> <uses-permission android:name="android.permission.USE_BIOMETRIC" /> <uses-permission android:name="android.permission.USE_FINGERPRINT" /> <uses-permission android:name="android.permission.GET_TASKS" /> <uses-permission android:name="android.permission.READ_PRIVILEGED_PHONE_STATE" /> <uses-permission android:name="android.permission.READ_PHONE_STATE" /> <uses-permission android:name="android.permission.RECEIVE_USER_PRESENT" /> <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="32" /> <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" /> <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" /> <uses-permission android:name="android.permission.READ_MEDIA_VIDEO" /> <uses-permission android:name="android.permission.FOREGROUND_SERVICE" /> <uses-permission android:name="android.permission.RECORD_AUDIO" /> <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" /> <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> <uses-permission android:name="android.permission.NFC" /> <uses-feature android:name="android.hardware.camera" android:required="true" /> <uses-feature android:name="android.hardware.nfc" android:required="false" /> <uses-permission android:name="android.permission.WRITE_SETTINGS" /> <uses-permission android:name="android.permission.READ_MEDIA_AUDIO" /> <uses-permission android:name="android.permission.POST_NOTIFICATIONS" /> <uses-permission android:name="android.permission.WAKE_LOCK" /> <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" /> <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" /> <uses-permission android:name="com.google.android.gms.permission.AD_ID" /> <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" /> <uses-permission android:name="android.permission.BLUETOOTH" android:maxSdkVersion="30" /> <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" /> <uses-permission android:name="com.asus.msa.SupplementaryDID.ACCESS" /> <uses-permission android:name="freemme.permission.msa" /> <uses-feature android:name="android.hardware.camera.autofocus" android:required="false" /> <uses-feature android:name="android.hardware.camera.flash" android:required="false" /> ``` The most intrusive permissions are the following: - **android.permission.SYSTEM_ALERT_WINDOW:** Allows an application to show system-alert windows. Applications can force themselves to the front without your control. - **android.permission.CAMERA:** Allows applications to take pictures and videos with the camera at all times. - **android.permission.GET_TASKS:** Allows applications to retrieve information about the currently and recently running tasks. May allow applications to discover private information about other applications. - **android.permission.READ_PHONE_STATE:** Allows applications to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on. - **android.permission.WRITE/READ_EXTERNAL_STORAGE:** Allows applications to read and write to the external storage. - **android.permission.READ_MEDIA_IMAGES/VIDEO/AUDIO:** Allows applications to read image/video/audio files from external storage. - **android.permission.RECORD_AUDIO:** Allows applications to access the audio record path. - **android.permission.ACCESS_COARSE_LOCATION:** Allows coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Applications can use this to determine where you are and may consume additional battery power - **android.permission.WRITE_SETTINGS:** Applications can modify the system's settings data, potentially corrupting it. - **android.permission.BLUETOOTH_CONNECT:** Applications can read and pair to Bluetooth devices

The application sends confidential information that uniquely identifies the device to multiple API endpoints, some may not be associated with WebSea. The information contained in the requests is the device IMEI, the user's IP, the API access token, the device token and the User ID / Pseudo ID.

Some pieces of information stored by the Websea Android application in memory were not erased from the device after a user successfully logged out. This could lead to the disclosure of sensitive information about the user, including their API access tokens and HTTP request responses. This increases the risk that sensitive information could be leaked if a device was lost or traded. Some of the preserved information after logging out was the tokens and identifying information generated by the initial user.

The "JSESSIONID" cookies set by the web application were found without the `Secure` flag set, making the cookies more vulnerable to various attacks. The `Secure` cookie security flag, it notifies the browser that the cookie can only be sent through encrypted channels. In cases in which the HTTP requests are sent through a cleartext channel, the browser will not append the cookie to the HTTP request sent to the server.

Certificate pinning is the process of associating the backend server with a particular X.509 certificate or public key instead of accepting any certificate signed by a trusted certificate authority. After storing ("pinning") the server certificate or public key, the mobile app will subsequently connect to the known server only. Withdrawing trust from external certificate authorities reduces the attack surface (after all, there are many cases of certificate authorities that have been compromised or tricked into issuing certificates to impostors). The certificate can be pinned and hardcoded into the app or retrieved at the time the app first connects to the backend. In the latter case, the certificate is associated with ("pinned" to) the host when the host is seen for the first time. This alternative is less secure because attackers intercepting the initial connection can inject their own certificates.

Missing Security Headers HTTP headers are well known and their implementation can make your application more versatile and secure. Modern browsers support many HTTP headers that can improve web application security to protect against clickjacking, cross-site scripting, and other common attacks. The important ones are missing and should be added to the response headers. They are listed below. - `Content-Security-Policy` - Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. - `X-Frame-Options` - X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN". - `X-Content-Type-Options` - X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". - `Referrer-Policy` - Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. - `Permissions-Policy` - Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. - HTTP Strict Transport Security (also named HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers. Note that not all headers will be relevant for each endpoint, but security best practices stipulate that these headers should be set for all server responses, regardless of content.