{"action":"opened","issue":{"url":"https://api.github.com/repos/blawrencensdemo/CircleCIIntegration/issues/250","repository_url":"https://api.github.com/repos/blawrencensdemo/CircleCIIntegration","labels_url":"https://api.github.com/repos/blawrencensdemo/CircleCIIntegration/issues/250/labels{/name}","comments_url":"https://api.github.com/repos/blawrencensdemo/CircleCIIntegration/issues/250/comments","events_url":"https://api.github.com/repos/blawrencensdemo/CircleCIIntegration/issues/250/events","html_url":"https://github.com/blawrencensdemo/CircleCIIntegration/issues/250","id":268558888,"number":250,"title":"Lab Automated static analysis: Dynamic Code Loading","user":{"login":"blawrencensdemo","id":29762235,"avatar_url":"https://avatars3.githubusercontent.com/u/29762235?v=4","gravatar_id":"","url":"https://api.github.com/users/blawrencensdemo","html_url":"https://github.com/blawrencensdemo","followers_url":"https://api.github.com/users/blawrencensdemo/followers","following_url":"https://api.github.com/users/blawrencensdemo/following{/other_user}","gists_url":"https://api.github.com/users/blawrencensdemo/gists{/gist_id}","starred_url":"https://api.github.com/users/blawrencensdemo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blawrencensdemo/subscriptions","organizations_url":"https://api.github.com/users/blawrencensdemo/orgs","repos_url":"https://api.github.com/users/blawrencensdemo/repos","events_url":"https://api.github.com/users/blawrencensdemo/events{/privacy}","received_events_url":"https://api.github.com/users/blawrencensdemo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-10-25T21:41:01Z","updated_at":"2017-10-25T21:41:01Z","closed_at":null,"author_association":"OWNER","body":"### Summary\nPlatform: android\nPackage: bscorp.appbase\n\nChecks for the use of dynamic code loading within the APK. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime, however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (i.e. a non-invasive update feature), it can also open the application to serious security vulnerabilities if not implemented properly.\n\n### Risk and Regulatory information\nSeverity: medium\nCVSS: 4.3\n\nCWE: [545](https://cwe.mitre.org/data/definitions/545.html)\nOWASP: [Mobile Top 10: M8-Code Tampering](https://www.owasp.org/index.php/Mobile_Top_10_2016-M8-Code_Tampering)\n\n\n### Details\nYour application was found to be using dynamic code loading. While this is not a vulnerability per se, it is not a secure code practice and can lead to code injection or malicious side-loading of code.\n\n### Recommendation\nIt is strongly discouraged to load code from outside of the application APK. Doing so significantly increases the likelihood of application compromise due to code injection or code tampering. It also adds complexity around version management, application testing and can make it impossible to verify the behavior of an application. Dynamically loaded code runs with the same security permissions as the application APK. If the modules are included directly within the APK, then they cannot be modified by other applications. This is true whether the code is a native library or a class being loaded using DexClassLoader. There can be instances of applications attempting to load code from insecure locations, such as downloaded from the network over unencrypted protocols or from world writable locations such as external storage. These locations could allow modification of the content in transit, or another application to modify the content on the device, respectively.\n\nView more details in Lab Automated: [https://lab.nowsecure.com/app/android/bscorp.appbase/assessment/1508967417967](https://lab.nowsecure.com/app/android/bscorp.appbase/assessment/1508967417967)"}}
{"actor":{"display_login":"blawrencensdemo"}}