# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 5 Low-Level Static Analysis
### CWEs  
This subsection succinctly details on all the high severity CWEs that are pertinent to each app. Notably, from them, CWE-89 currently belongs to the list of top 25 most dangerous software weaknesses [65], while CWE-295 and CWE-532 occupy positions 28 and 33 in the extended list, respectively. * _CWE-250:_ It is known as \"Execution with unnecessary privileges\". Typically, it means that the app may request root access privileges. Therefore, the app is potentially able to disable any security checks that will be performed by the Android operating system (OS), which resembles the case of having a rooted device. Three apps were found to be susceptible to this weakness. * _CWE-330:_ The \"Use of insufficiently random values\" vulnerability is related to the generation of predictable random values inside the app. This issue occurs if the app uses an insecure random number generator. In OWASP top 10 mobile riskslist (OWASP-10), this weakness is placed in the fifth position, namely \"insufficient cryptography\". Surprisingly, all the examined apps suffer from this weakness. * _CWE-276_: This CWE, namely \"Incorrect default permissions\", occurs if the app is granted unneeded read/write permissions. So, any affected file can be potentially read/written from anyone. With reference to OWASP-10, this weakness is classified under M2, namely, \"insecure data storage\". As seen from Table 5, all apps were vulnerable to this weakness for at least one of the following reasons. The first, is related to the creation of a temp file, which may contain sensitive data. This is a major issue, since anyone can access folders that contain temp files, say, \"/data/local/tmp/**. The second pertains to the fact that the app requests (read/write) access to the external storage. * _CWE-532_: This weakness, namely, \"Insertion of sensitive information into log file\", emerges when a production app has enabled logging information to a file. While this feature may be helpful during the development stage of an app, it must be striped away before the app becomes publicly available. Put simply, an attacker could read these files and acquire any private information stored on them. All apps but one were vulnerable to this issue. * _CWE-312_: It is known as \"Cleartext storage of sensitive information\", and is classified as M9 in OWASP-10. Naturally, when sensitive information, say, a username and/or password, are stored in cleartext form, anyone can read them. In some cases, this information may be stored inside the code of the app, e.g., in a configuration file. As observed from Table 5, only four apps were immune to this weakness. * _CWE-89_: This extremely dangerous weakness, titled \"Improper neutralization of special elements used in an SQL command (\"SQL Injection\")\" is classified as M7 in OWASP-10. It occurs when the app does not sanitise or improperly sanitises input stemming from an upstream component, say, from a Web form for user authentication. All but four apps were found to be potentially vulnerable to this issue. * _CWE-327_: It is referred to as \"Use of a broken or risky cryptographic algorithm\", and it belongs to M5 (\"Insufficient Cryptography\") of OWASP-10. This weakness relates to the usage of obsolete or risky encryption or hash algorithms. As seen in Table 5, all but two apps may potentially use at least one obsolete hash algorithm, namely MD5 or SHA-1, and nine of them support AES-ECB. * _CWE-295_: This weakness titled \"Improper certificate validation\" is classified under M3 (\"Insecure Communication\") in OWASP-10. This happens when the app is configured to trust an insecure or self-signed or any kind of certificate. As already mentioned, this situation may allow assistants to instigate MitM attacks. Two of the examined apps suffer from this weakness due to an insecure implementation of TLS. * _CWE-749_: It is known as \"Exposed dangerous method or function\", and it belongs to M1 (\"Improper Platform Usage\") of OWASP-10.