CVE-2021-41096: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 7.5
Published: 2021-09-27T20:15Z
Repository: https://github.com/mayankmetha/Rucky
Language: Java
Files changed: app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java, app/src/main/java/com/mayank/rucky/utils/Constants.java, app/src/main/java/com/mayank/rucky/utils/Randoms.java
Commit date: 2021-09-25 16:34:34 +0530
Commit message: Fix security vulnerabilities

Diff: diff --git a/app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java b/app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java
index 030d641..6dd092a 100644
--- a/app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java
+++ b/app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java
@@ -138,12 +138,12 @@ public class ConfigActivity extends AppCompatActivity {
 
     private void updateStatus() {
         if (config.getHIDMode() == 0) {
             config.setNetworkStatus(false);
             EditorActivity.stopNetworkSocketService(this);
-            ipButton.setVisibility(View.GONE);
-            ipStatusDivider.setVisibility(View.GONE);
+            ipButton.setVisibility(View.INVISIBLE);
+            ipStatusDivider.setVisibility(View.INVISIBLE);
             if (config.getUSBStatus()) {
                 statusText.setText(R.string.config_status_usb_on);
                 statusImage.setImageDrawable(ContextCompat.getDrawable(this, R.drawable.ic_usb));
             } else {
                 statusText.setText(R.string.config_status_usb_off);
diff --git a/app/src/main/java/com/mayank/rucky/utils/Constants.java b/app/src/main/java/com/mayank/rucky/utils/Constants.java
index 2687fad..0d092e5 100644
--- a/app/src/main/java/com/mayank/rucky/utils/Constants.java
+++ b/app/src/main/java/com/mayank/rucky/utils/Constants.java
@@ -33,16 +33,10 @@ public class Constants {
     public static final String PREF_HID_MODE = "hidMode";
     public static final String PREF_HID_INTENT = "hidIntent";
     public static final String PREF_HID_FILE = "hidFile";
     public static final String PREF_HID_FILE_SELECTED = "hidFileSelected";
 
-    //keystore
-    public static final String PREF_GEN_KEY = "genKeyDone";
-    public static final String KEYSTORE_PROVIDER_ANDROID_KEYSTORE = "AndroidKeyStore";
-    public static final String RUCKY_KEYSTORE = "RuckyKeystore";
-    public static final String RUCKY_KEYSTORE2 = "RuckyKeystore2";
-
     //notifications
     public static final String CHANNEL_ID = "com.mayank.rucky.update";
     public static final String CHANNEL_NAME = "Update";
     public static final String SCHANNEL_ID = "com.mayank.rucky.service";
     public static final String SCHANNEL_NAME = "Foreground Service";
diff --git a/app/src/main/java/com/mayank/rucky/utils/Randoms.java b/app/src/main/java/com/mayank/rucky/utils/Randoms.java
index 016ba9d..4b17124 100644
--- a/app/src/main/java/com/mayank/rucky/utils/Randoms.java
+++ b/app/src/main/java/com/mayank/rucky/utils/Randoms.java
@@ -1,16 +1,16 @@
 package com.mayank.rucky.utils;
 
 import java.util.Date;
-import java.util.Random;
+import java.security.SecureRandom;
 
 public class Randoms {
 
-    Random random;
+    SecureRandom random;
 
     Randoms() {
-        random = new Random();
+        random = new SecureRandom();
         Date date = new Date();
         random.setSeed(date.getTime());
     }
 
     public int randomTheme() {

Vulnerable code:             ipButton.setVisibility(View.GONE);
            ipStatusDivider.setVisibility(View.GONE);
    //keystore
    public static final String PREF_GEN_KEY = "genKeyDone";
    public static final String KEYSTORE_PROVIDER_ANDROID_KEYSTORE = "AndroidKeyStore";
    public static final String RUCKY_KEYSTORE = "RuckyKeystore";
    public static final String RUCKY_KEYSTORE2 = "RuckyKeystore2";

import java.util.Random;
    Random random;
        random = new Random();
Fixed code:             ipButton.setVisibility(View.INVISIBLE);
            ipStatusDivider.setVisibility(View.INVISIBLE);
import java.security.SecureRandom;
    SecureRandom random;
        random = new SecureRandom();