Fortify对移动应用安全的支持.docx

对Android的支持2案例-ExploitMe Mobile Android Labs2Privacy Violation3Insecure Randomness4Password Management:Hardcoded Password5Unreleased Resource:Streams5Denial of Service6JavaScript Hijacking:Vulnerable Framework6Password Management:Password in Comment7Poor Error Handling:Overly Broad Catch7Unchecked Return Value8对iOS的支持8Objective-C 漏洞规则8API Abuse9Code Quality13Encapsulation17Input Validation and Representation22Security Features37对Android的支持对Android的支持：Java (with Android)1.3, 1.4, 1.5, 1.6, 1.7Eclipse 3.4, 3.5, 3.6, 3.7, 3.8, 4.2 Translating Google Android CodeSSR provides rules support for programs that run on the Google Android platform. These rulesidentify insecure data storagecategorize applications by their security permissions and detect overprivileged usessend and receive intents, identify database, file system, web, private information and Android intercomponentsourcesTranslating Google Android code is similar to translating Java code.案例-ExploitMe Mobile Android LabsFortify没有针对Android专门的扫描，把Android项目作为Java项目扫描Update Project Translation：指定Android SDK的CLASSPATH：Privacy Violation类似的错误在AppScan Source称之为“Validation.EncodingRequired”Insecure Randomness属于误报C:\tmp\AndroidLabs-Base\assets\Password Management:Hardcoded PasswordUnreleased Resource:StreamsDenial of Service同样的问题在AppScan Source报“AppDOS.readLine”JavaScript Hijacking:Vulnerable Framework误报Password Management:Password in CommentPoor Error Handling:Overly Broad CatchUnchecked Return Value对iOS的支持对iOS的支持：Mac OS编译器支持：Clang 2.9, 3.0, 3.1LLVM-GCC 4.2, 4.3Xcodebuild版本支持：4.1, 4.2, 4.2.1, 4.3, 4.3.1, 4.4, 4.5, 4.6iOS projects compiled using Objective-C require iOS SDK version 5 through 6, and Xcode versions 4.1 through 4.6.Objective-C漏洞规则API AbuseAn API is a contract between a caller and a callee. The most common forms of API abuse are caused by the caller failing to honor its end of this contract. For example, if a program fails to call chdir() after calling chroot(), it violates the contract that specifies how to cha