UvToken

The application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android <7.0 The Janus vulnerability stems from the possibility to add extra bytes to APK files and to DEX files. On the one hand, an APK file is a zip archive, which can contain arbitrary bytes at the start, before its zip entries (actually more generally, between its zip entries). The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application’s signature. On the other hand, a DEX file can contain arbitrary bytes at the end, after the regular sections of strings, classes, method definitions, etc. A file can, therefore, be a valid APK file and a valid DEX file at the same time. References: - https://www.xda-developers.com/janus-vulnerability-android-apps/ - https://medium.com/mobis3c/exploiting-apps-vulnerable-to-janus-cve-2017-13156-8d52c983b4e0

When analyzing the `Info.plist` file, we found that the application sets `NSAllowsArbitraryLoads` to `true`, which completely disables ATS for all network connections.

It was found that cleartext traffic was configured to be permitted within the `AndroidManifest.xml` file of the Android application package.

The `UvToken` application does not adequately detect if the device is rooted/jailbroken. As a result, the data which is stored by the applications can be exposed when the device is rooted or jailbroken.

On mobile devices, a screenshot of the current activity is taken when an application goes into the background and displayed for aesthetic purposes when the app returns to the foreground. This feature may pose a security risk. Sensitive data may be exposed if the user background the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data.  Even though the iOS version was blurring the content of the screenshot when the application was in background, it is worth mentioning that it was not done right after using the multitask gesture, but after exiting it. Other secure applications tend to blur the content right when the multitask functionality is used.

The iOS and Android applications were interacting with third party services located on different domains.

The UvToken iOS application used the data directory to store information related to the user, like the HTTP Cache, which contains session information and temporary files, but the protection classes associated to those items were not sufficiently secure. When a new file is created on the data directory, it is assigned a protection class by the application that creates it. Each class uses different policies to determine when the data is accessible. Data Protection is an encryption framework provided by Apple to offer file encryption capabilities to the file system. This framework is active by default although the default settings are rarely appropriate. The default option for items in the data directory is `NSFileProtectionCompleteUntilFirstUserAuthentication`. As the name implies, items are encrypted until the first time the user log in, then all files are saved in clear text.

The affected endpoints used a wildcard SSL certificate. Such certificates offer a cost-effective means of extending SSL/TLS coverage across multiple servers and applications. However, although wildcard certificates are cryptographically no weaker than dedicated certificates, the effective security level is reduced to that of the weakest application or component.