Case UC-05 · OWASP M10 Insufficient Cryptography

Hard-coded key used for local data encryption

An app encrypted local data with a symmetric key that was compiled into the binary and identical for every user, reducing the protection to obfuscation that a single extraction defeats.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

An app encrypted local records with a symmetric key, but the key was a constant compiled into the binary and identical across every installation. The same value therefore protects every user's data everywhere the app is installed.

2 What the research team found

The team extracted the constant key and traced it into the cipher routine. Because the key is static and shared, any ciphertext recovered from a device is decryptable offline by anyone who has the app, so the encryption provides confusion rather than confidentiality.

3 Why it matters

A shared hard-coded key gives a false assurance that data is encrypted while providing no real protection. One extraction breaks confidentiality for the entire user base at once, and the key cannot be rotated without shipping a new build and re-encrypting existing data.

4 How Mobexa surfaces it

Mobexa detects static keys and weak or homegrown cryptography, traces constants into cipher calls, and flags key material that is not managed by the platform keystore, reporting under M10.

5 Remediation

Derive per-device keys from the platform keystore or keychain, never embed key material in the binary, and use vetted authenticated-encryption primitives. Treat any in-binary constant that feeds a cipher as a finding to be remediated.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M10 Insufficient Cryptography
CWE CWE-321 Use of Hard-coded Cryptographic Key
OWASP MASVS MASVS-CRYPTO
cryptographykeysstorage

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).