...
| Tool | Version | Checker | Description |
|---|---|---|---|
| Fortify | 1.0 | Password_Management Password_Management__Hardcoded_Password | Partially Implemented |
| Coverity | 1.0 | FB.DMI_CONSTANT_DB_ PASSWORD | Partially Implemented |
| PMD | 1.0 | AvoidUsingHardCodedIP | Partially Implemented |
Related Vulnerabilities
GERONIMO-2925, GERONIMO-1135 describes a vulnerability in the WAS CE tool, which is based on Apache Geronimo. It uses the Advanced Encryption Standard (AES) to encrypt passwords but uses a hard-coded key that is identical for all the WAS CE server instances. Consequently, anyone who can download the software is provided with the key to every instance of the tool. This vulnerability was resolved by having each new installation of the tool generate its own unique key and use it from that time on.
Related Guidelines
MSC18-C. Be careful while handling sensitive data, such as passwords, in program code | |
Hard-coded Password [XYP] | |
CWE-259. Use of hard-coded password | |
| CWE-798. Use of hard-coded credentials |
Android Implementation Details
Hard coded information can be easily obtained on Android by using the apktool to decompile an application or by using dex2jar to convert a dex file to a jar file.
Bibliography
11.2, Outbound Passwords: Keep Passwords out of Source Code | |
Unsafe Mobile Code: Database Access | |
9.4, Private Object State and Object Immutability |
...