Skip to content

Commit 2be8ce8

Browse files
Oussama-BakriOussama-Bakri
authored
Merge pull request #270 from Ostorlab/feature/add-device-identifier-kb
feature: add device identifier kb
2 parents dec7c2b + 74c7a35 commit 2be8ce8

5 files changed

Lines changed: 80 additions & 2 deletions

File tree

‎MOBILE_CLIENT/ANDROID/_LOW/INTENT_SPOOFING/meta.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"risk_rating": "medium",
33
"short_description": "The application is vulnerable to intent spoofing which may lead to inappropriate access like data modification, information disclosure and data injection.",
44
"references": {
5-
"Do not act on malicious intent (CERT Secure Coding)": "https://www.securecoding.cert.org/confluence/display/android/DRD06.+Do+not+act+on+malicious+intents",
5+
"DRD06. Verify the caller of intents before acting on them": "https://wiki.sei.cmu.edu/confluence/display/android/DRD06.+Verify+the+caller+of+intents+before+acting+on+them",
66
"Improper Access Control (CWE-284)": "https://cwe.mitre.org/data/definitions/284.html",
77
"Intent Spoof (CAPEC-502)": "https://capec.mitre.org/data/definitions/502.html",
88
"Analyzing Inter-Application Communication in Android": "https://people.eecs.berkeley.edu/~daw/papers/intents-mobisys11.pdf"

‎MOBILE_CLIENT/COMMON/_LOW/COLLECTION_DEVICE_IDENTIFIER/description.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Collection of Device Identifiers
2+
3+
A **device identifier** is any value—hardware-based, platform-provided, or application-generated—that remains stable over time and can be used to uniquely identify a device or user across sessions. These identifiers enable device recognition and long-term correlation of activity, but also introduce significant privacy considerations.
4+
5+
There are typically three families:
6+
7+
## Hardware-Based Identifiers
8+
9+
Hardware identifiers come from the device’s physical components or firmware and usually remain constant for the lifetime of the device.
10+
11+
* **IMEI / MEID**: Unique modem identifiers historically used to identify mobile devices. Access is highly restricted on modern operating systems.
12+
* **Serial Number**: A unique hardware identifier assigned by the manufacturer. Generally not accessible to normal applications.
13+
14+
## Platform-Provided Identifiers
15+
16+
Operating systems expose identifiers with limited scope or permissions.
17+
18+
* **Android ID**: A stable, app-scoped identifier that persists across reinstalls for the same app and signing key on modern Android versions.
19+
* **IDFV (Identifier for Vendor)**: An iOS identifier shared across apps belonging to the same vendor, reset only if all of the vendor’s apps are uninstalled.
20+
* **IDFA (Advertising Identifier)**: A user-resettable identifier used for advertising and analytics, available only with user consent under modern privacy frameworks.
21+
22+
## Application-Generated Identifiers
23+
24+
Applications may generate their own identifiers and store them persistently.
25+
26+
* **Custom UUIDs**: Random identifiers stored in local storage or secure system keychains, potentially surviving app reinstalls.
27+
* **Derived or hashed identifiers**: Values created by combining device attributes.
28+
29+
These identifiers function as device identifiers if they can be used to correlate user activity over time.
30+
31+
## Privacy & Regulatory Considerations
32+
33+
Under major privacy regulations such as **GDPR**, **CCPA**, and similar frameworks, persistent device identifiers are classified as **personal data** because they allow the identification or tracking of a user or device. Improper handling may violate:
34+
35+
* **Data minimization**
36+
* **Purpose limitation**
37+
* **Transparency requirements**
38+
* **Consent obligations**
39+
40+
Platform policies (e.g., Apple App Store, Google Play) further restrict the use of persistent identifiers for analytics, advertising, or cross-app tracking without explicit user authorization.
41+
42+
## Security & Compliance Implications
43+
44+
Persistent identifiers can be misused for:
45+
46+
* Device fingerprinting
47+
* Cross-app or cross-service tracking
48+
* Behavioral profiling
49+
50+
Because of this, they require careful handling and justification for collection.

‎MOBILE_CLIENT/COMMON/_LOW/COLLECTION_DEVICE_IDENTIFIER/meta.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"risk_rating": "low",
3+
"short_description": "The application collects a device identifier that can be used to track users across sessions and applications.",
4+
"references": {
5+
"Android Developers - Identifiers": "https://developer.android.com/training/articles/user-data-ids",
6+
"Android Developers - App Set ID": "https://developer.android.com/training/articles/app-set-id",
7+
"Apple Developer - Identifier for Vendor (IDFV)": "https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor"
8+
},
9+
"title": "Collection of Device Identifier",
10+
"cvss_v3_vector": "",
11+
"privacy_issue": true,
12+
"security_issue": false,
13+
"categories": {}
14+
}

‎MOBILE_CLIENT/COMMON/_LOW/COLLECTION_DEVICE_IDENTIFIER/recommendation.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## Recommendation
2+
3+
For secure and privacy-respecting handling of persistent device identifiers, it is crucial to follow best practices that minimize tracking risks and comply with privacy regulations. Two general strategies are recommended:
4+
5+
* **Limit Collection and Prefer Safer Identifiers**: Only collect persistent device identifiers when strictly necessary for core application functionality. Avoid hardware-based identifiers like IMEI or serial numbers unless there is a compelling operational need. When collection is required, prefer safer alternatives such as platform-approved app-scoped identifiers (e.g., Android’s App Set ID, iOS’s IDFV) or ephemeral/custom-generated UUIDs stored securely for the duration of the app lifecycle.
6+
7+
8+
* **Transparency and Consent**: Clearly document the purpose of collecting any persistent identifier. Disclose collection practices in the privacy policy and obtain user consent where legally required.
9+
10+
* **Secure Storage**: Store any persistent identifiers securely using platform-provided secure storage mechanisms (e.g., Android Keystore, iOS Keychain). Avoid storing identifiers in plain text or in locations accessible to other apps.
11+
12+
* **Avoid Cross-App Tracking**: Do not use persistent identifiers for advertising, analytics, or tracking across multiple apps unless explicitly allowed by platform policies and user consent.
13+
14+
By following these best practices, applications can reduce privacy risks, comply with regulatory requirements, and maintain user trust.

‎MOBILE_CLIENT/COMMON/_MEDIUM/INSECURE_PASSWORD_STORAGE/meta.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"risk_rating": "medium",
55
"references": {
66
"OWASP Insecure Cryptographic Storage": "https://www.owasp.org/index.php/Top_10_2010-A7-Insecure_Cryptographic_Storage",
7-
"OWASP Insecure Storage": "https://www.owasp.org/index.php/Insecure_Storage",
7+
"OWASP Insecure Data Storage": "https://owasp.org/www-project-mobile-top-10/2023-risks/m9-insecure-data-storage",
88
"CWE-522 Insufficiently Protected Credentials": "https://cwe.mitre.org/data/definitions/522.html",
99
"CWE-312 Cleartext Storage of Sensitive Information": "https://cwe.mitre.org/data/definitions/312.html",
1010
"CWE-256 Plaintext Storage of a Password": "https://cwe.mitre.org/data/definitions/256.html"

0 commit comments

Comments
 (0)