False negatives: hardcoded secrets

[vasconcedu]

I'm performing an academic experiment in which I'm seeding vulnerabilities in mobile app codebases and then trying to find them. I'm using mobsfscan for this purpose.

I believe it is failing to find hardcoded secrets in some cases. There is no significant entropic difference between the hardcoded secrets which it is able to find successfully and hardcoded secrets which it fails to find.

For instance, it successfully reported the following excerpt as a hardcoded secret:

private static final String KEY = "fa753769876edbdb876704bc0111b2a681d321afe631ffd5aacd20e2754f2a39181613c8d2f21e336d5e270bff900be643a19c1ddfb00b9008e580cacf9b1e36bcbc5ec7db1949f4f46a3f348cae5a4eedace9de32687c885d4d8e1facd0db26fea33b899bd761fb2ffd44ceb634c42541ee79ae6eb3b6f34afff0b5382524250258c32f6f22946ad44ea80e06db20317e565c445f35ef3cd6bc2d688e4832b0cfda99b4c88ef1fefbcd7e5a0e9641294142b8a6fbfc2423b99feeb810f720c63aa1f6ddc4d25455177384a9d5660772be91f231f24022de7f22e60961db971d42f268089f4be8c40c214e2d6e95d35827386aa9f777e371a4f1e817880ea693";

But it failed to report the following excerpt as a hardcoded secret:

private val KEY = "b4071281f217866037bb02f1d125ab5c2533eca404e95b9f19f097227bcaad4fffb8aeda6042f4225623a1a23e50ed669ca508b570ba0f53306d6eb7b04941c9f3047e564ec9c0afef3ecadf5493edb6c0b4432ecde5f1f644e7dafa727774d3a43f472845d855113f0bb7ffe79bf80efa6bdb0f53607f691bc1ad65d3503c7b8847e6a50f884abf017047ad4144c6f1561c4b5653b7b8251db0f9757ab55562dd432dbd75479d5282cf08658f4fe52b175d7fc476b59e625abb057d9413d62d080a5050a47795536f594407aaa89f1df88abba879d091e81abe37ef74bb01912df82e4b10ea3e25bba80f837d0153917442c611f411093fbacd30aab4158719"

I have found numerous instances of this failure pattern, and I can provide further detail and samples if necessary. What's more, as much as I cannot generalize this observation based solely on the results I have obtained so far, in my experimental setting, I have noticed that false negatives like this seem to occur specifically for apps coded in Kotlin.

[ajinabraham]

Kotlin rule for secret detection is

mobsfscan/mobsfscan/rules/patterns/android/kotlin/kotlin_rules.yaml

Line 337 in 0ef8c86

(password\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(pass\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(username\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(secret\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(key\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})

It checks only for variables under 100 chars. This string is relatively large to be considered as a secret key. It should work for a shorter variable. https://regex101.com/r/Qn6Yvp/1

[vasconcedu]

Thanks for the update. I'm unable to address this issue right now, but a string with that level of entropy should arguably be reported as a secret (most private keys, for instance, would likely exceed 100 chars). If you agree, I may be able to contribute by refining this rule in the near future. Would a PR for this be welcome?