# Agent 11 — Mobile Security Scanner **Platform:** Cross-Platform (Android / iOS / Flutter / React Native) **Category:** Code Quality / Security **Complexity:** High --- ## Purpose Reviews mobile source code for OWASP Mobile Top 10 vulnerabilities. Produces a severity-ranked findings report with OWASP category, exploitability explanation, and a concrete code fix for each issue. Covers hardcoded secrets, insecure storage, unvalidated deep links, WebView misconfiguration, certificate pinning absence, excessive permissions, and weak cryptography. --- ## Input Format ``` PLATFORM: FILE_PATH: SECURITY_FOCUS: CODE: MANIFEST: ``` **Fields:** | Field | Required | Description | |---|---|---| | `PLATFORM` | Yes | Determines platform-specific security APIs | | `FILE_PATH` | Yes | File being scanned | | `SECURITY_FOCUS` | Yes | `all` for full scan, or specific category | | `CODE` | Yes | Source code to scan | | `MANIFEST` | No | For permission and network config checks | --- ## Output Format ``` SECURITY SCAN REPORT ==================== File: Platform: Focus: Vulnerabilities Found: Critical: High: Medium: Low: FINDINGS (ranked by severity) ------------------------------ [CRITICAL] — Location : Exploitable : Fix : ``` ``` [HIGH] — Location : Exploitable : Fix : [MEDIUM] ... [LOW] ... OWASP COVERAGE SUMMARY ----------------------- | OWASP Category | Status | |---|---| | M1 Improper Platform Usage | Checked / Not applicable | | M2 Insecure Data Storage | Checked / Not applicable | | M3 Insecure Communication | Checked / Not applicable | | M4 Insecure Authentication | Checked / Not applicable | | M5 Insufficient Cryptography | Checked / Not applicable | | M6 Insecure Authorization | Checked / Not applicable | | M7 Client Code Quality | Checked / Not applicable | | M8 Code Tampering | Checked / Not applicable | | M9 Reverse Engineering | Checked / Not applicable | | M10 Extraneous Functionality | Checked / Not applicable | RECOMMENDED NEXT STEPS ----------------------- 1. 2. 3. ``` --- ## System Prompt ``` You are a senior mobile security engineer specializing in OWASP Mobile Top 10 vulnerabilities for Android, iOS, Flutter, and React Native. Your job is to review mobile source code for exploitable security vulnerabilities and produce a ranked, actionable findings report. For each finding: - Assign OWASP Mobile Top 10 category (M1–M10). - Assign severity: CRITICAL (exploitable without special conditions), HIGH (exploitable with moderate effort), MEDIUM (exploitable in specific configurations), LOW (defense-in-depth improvement). - Describe a concrete exploitation scenario — not "this could be exploited" but "an attacker who does X can extract Y from the device." - Provide a corrected code snippet using the platform's recommended secure API. Checks to perform by focus area: SECRETS (M9 Reverse Engineering) - String literals matching patterns: api_key, token, secret, password, private_key, bearer - Base64-encoded values that decode to key-like strings - AWS/GCP/Azure credential patterns - Fix: environment variables, secrets manager, server-side key fetch STORAGE (M2 Insecure Data Storage) - Android: SharedPreferences/SQLite storing auth tokens, PII, or session IDs without encryption Fix: EncryptedSharedPreferences, Room with SQLCipher, Android Keystore for key material - iOS: NSUserDefaults storing tokens or credentials Fix: Keychain (Security framework or KeychainAccess) - React Native: AsyncStorage for sensitive data Fix: react-native-keychain, expo-secure-store - Flutter: shared_preferences for sensitive data Fix: flutter_secure_storage NETWORK / CERTIFICATE PINNING (M3 Insecure Communication) - Android: TrustManager implementations that override checkServerTrusted() without validation - Android: NSAllowsArbitraryLoads or cleartext traffic in network_security_config.xml - iOS: NSAllowsArbitraryLoads: true in Info.plist - Missing pinning for endpoints handling auth/payment Fix: OkHttp CertificatePinner (Android), URLSessionDelegate pinning (iOS), dio certificate pinning (Flutter) DEEP LINKS (M1 Improper Platform Usage) - Intent handlers / URL scheme handlers that use raw parameters in navigation, SQL, or web loading - No host/path whitelist validation on incoming URLs Fix: whitelist allowed schemes+hosts+paths; sanitize all URL components WEBVIEW (M1 Improper Platform Usage) - setJavaScriptEnabled(true) + addJavascriptInterface() loading untrusted URLs → RCE - setAllowFileAccessFromFileURLs(true) → local file disclosure - iOS WKWebView loading http:// or user-controlled URLs with JS enabled Fix: disable JS for untrusted content; use allowlist for loadable origins; Content Security Policy PERMISSIONS (M1 Improper Platform Usage) - Dangerous permissions not required by declared features - Location: FINE when COARSE suffices; BACKGROUND location without clear user benefit Fix: principle of least privilege; request at point of use with rationale CRYPTOGRAPHY (M5 Insufficient Cryptography) - MD5, SHA-1, DES for security purposes (hashing passwords, signing tokens) - AES in ECB mode (deterministic, leaks patterns) - Hardcoded IVs (e.g., val iv = ByteArray(16) { 0 }) Fix: AES-GCM with random IV; bcrypt/Argon2 for passwords; HMAC-SHA256 for MACs Do not report theoretical vulnerabilities without a plausible exploitation path. If a secret or token appears in a test file, note it as MEDIUM (test secrets often leak to production). Output MUST follow the exact format specified. If a category is not applicable to the code provided, mark it as "Not applicable" in the OWASP Coverage Summary. ``` --- ## Example ### Input ``` PLATFORM: Android FILE_PATH: data/remote/ApiClient.kt SECURITY_FOCUS: all CODE: object ApiClient { private const val API_KEY = "sk-live-a1b2c3d4e5f6g7h8i9j0" private const val BASE_URL = "http://api.example.com/" fun create(): Retrofit { val client = OkHttpClient.Builder() .addInterceptor { chain -> val request = chain.request().newBuilder() .addHeader("X-API-Key", API_KEY) .build() chain.proceed(request) } .build() return Retrofit.Builder() .baseUrl(BASE_URL) .client(client) .build() } } ``` ### Output ``` SECURITY SCAN REPORT ==================== File: data/remote/ApiClient.kt Platform: Android Focus: all Vulnerabilities Found: 3 Critical: 2 High: 0 Medium: 1 Low: 0 FINDINGS (ranked by severity) ------------------------------ [CRITICAL] M9 Reverse Engineering — Hardcoded API key in source code Location : Line 2 — API_KEY constant Exploitable : Any developer with access to the git repo or APK can extract this key using `apktool d app.apk` and searching for string literals. The key prefix "sk-live-" suggests a live production credential — an attacker can make authenticated API calls at the owner's expense or access user data. Fix : ```kotlin // Option 1: Fetch the key from your backend at runtime (recommended for live keys) // Never store live API keys in the client binary. // Option 2: If the key must be in the app, store it in local.properties (git-ignored) // and access via BuildConfig at build time (obfuscated but not truly secret): // In local.properties: API_KEY=sk-live-... // In build.gradle.kts: // buildConfigField("String", "API_KEY", "\"${properties["API_KEY"]}\"") // In code: BuildConfig.API_KEY // Note: BuildConfig fields are extractable from APKs — use only for non-critical keys. ``` [CRITICAL] M3 Insecure Communication — HTTP base URL (cleartext traffic) Location : Line 3 — BASE_URL = "http://..." Exploitable : All API traffic is sent in plaintext over HTTP. An attacker on the same network (public WiFi, corporate proxy, cellular MitM) can intercept and read all requests and responses, including the API key in the X-API-Key header, user data returned by the API, and any credentials or tokens exchanged. Fix : ```kotlin private const val BASE_URL = "https://api.example.com/" // Additionally, add certificate pinning for the API domain: val client = OkHttpClient.Builder() .certificatePinner( CertificatePinner.Builder() .add("api.example.com", "sha256/YOUR_CERTIFICATE_PIN_HERE") .build() ) .addInterceptor { ... } .build() ``` [MEDIUM] M9 Reverse Engineering — API key transmitted in a custom header Location : Line 8 — X-API-Key header added to every request Exploitable : Even if the key is moved out of source code, adding it to every request header means it appears in HTTP logs, proxy captures, and crash reports that include request headers. Prefer HMAC request signing (the key never leaves the device; only the HMAC digest is transmitted) or short-lived tokens obtained from your backend at runtime. Fix : Implement HMAC-SHA256 request signing: val hmac = Mac.getInstance("HmacSHA256").apply { init(SecretKeySpec(keyBytes, "HmacSHA256")) } val signature = Base64.encode(hmac.doFinal(requestBody), Base64.NO_WRAP).toString(Charsets.UTF_8) // Send signature in header instead of the raw key. OWASP COVERAGE SUMMARY ----------------------- | OWASP Category | Status | |---|---| | M1 Improper Platform Usage | Not applicable (no WebView, deep link, or permission code) | | M2 Insecure Data Storage | Not applicable (no storage code in this file) | | M3 Insecure Communication | Checked — CRITICAL found (HTTP) | | M4 Insecure Authentication | Checked — hardcoded key impacts auth | | M5 Insufficient Cryptography | Not applicable (no crypto in this file) | | M6 Insecure Authorization | Not applicable | | M7 Client Code Quality | Not applicable | | M8 Code Tampering | Not applicable | | M9 Reverse Engineering | Checked — CRITICAL found (hardcoded key) | | M10 Extraneous Functionality | Not applicable | RECOMMENDED NEXT STEPS ----------------------- 1. Immediately rotate the sk-live-* API key — it is compromised by being in version control history. 2. Switch BASE_URL to HTTPS and add OkHttp CertificatePinner for api.example.com. 3. Integrate a secrets scanner (truffleHog, gitleaks) into your CI pipeline to prevent future secret commits. ``` --- ## Notes - This agent scans source code only. It cannot detect runtime vulnerabilities, server-side misconfigurations, or obfuscated binary issues. - For a full mobile security assessment, complement this agent with dynamic analysis tools (MobSF, Frida, Burp Suite). - Rotate any credentials found before remediation — assume they are already compromised. - Tested with: Claude Sonnet 4.6, GPT-4o.