NowSecure dynamic analysis: Weak Cryptographic Hashing Algorithms

Finding Description

Source code should be inspected for uses of weak cryptographic algorithms. The inspections may reveal the use of weak cryptography by third party code. Use the 'Findings Evidence' to determine what insecure APIs were observed during analysis.

Steps to Reproduce

While the application runs, cryptographic APIs are monitored to identify any insecure usage of cryptographic algorithms or primitives. Insecure hashing algorithms include uses of MD2, MD3, MD4, MD5 and SHA1.

Insecure cryptographic hashing algorithms were detected in use by the application.

Business Impact

Remediation Resources

Utilize cryptographic hashing algorithms that are considered secure and advocated for in best practice recommendation.
Guidance can be found for Android and from Apple.

For more guidance on best practices in picking strong cryptography, please see OWASP's Cryptographic Storage Cheat Sheet.

Risk and Regulatory Information

Severity: low
CVSS: 3.7

• CWE: 312
• ioXt: VS3
• FISMA MED: SC-28 PROTECTION OF INFORMATION AT REST
• Risk OWASP: Mobile Top 10: M2-Insecure Data Storage
• GDPR: Risks violating Article 25, Risks violating Article 32
• FFIEC: May violate D3.PC.Am.A.1
• PCI: May violate requirement 3.1 through 3.4
• HIPAA: May violate §164.312(a)(1): Standard: Access control.
• CCPA: Risks violating CCPA: exfiltration, theft, or disclosure of PII
• CWE Top 25: 2019 CWE Top 25 Most Dangerous Software Errors

Application

• Platform: android
• Package: com.microsoft.office.word

See more detail in the NowSecure Report

Start with the linked NowSecure Report and its Findings Evidence; the issue names no repository file, test, or insecure API. Confirm which weak hashing usage belongs to the Android package com.microsoft.office.word, then verify that the reported insecure algorithms are no longer detected after remediation.