{"action":"closed","issue":{"url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/30","repository_url":"https://api.github.com/repos/chrispeoples/browser_github_test","labels_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/30/labels{/name}","comments_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/30/comments","events_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/30/events","html_url":"https://github.com/chrispeoples/browser_github_test/issues/30","id":329575681,"node_id":"MDU6SXNzdWUzMjk1NzU2ODE=","number":30,"title":"Lab Automated dynamic analysis: Sensitive Data: Last Name (HTTP)","user":{"login":"chrispeoples","id":22162665,"node_id":"MDQ6VXNlcjIyMTYyNjY1","avatar_url":"https://avatars0.githubusercontent.com/u/22162665?v=4","gravatar_id":"","url":"https://api.github.com/users/chrispeoples","html_url":"https://github.com/chrispeoples","followers_url":"https://api.github.com/users/chrispeoples/followers","following_url":"https://api.github.com/users/chrispeoples/following{/other_user}","gists_url":"https://api.github.com/users/chrispeoples/gists{/gist_id}","starred_url":"https://api.github.com/users/chrispeoples/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrispeoples/subscriptions","organizations_url":"https://api.github.com/users/chrispeoples/orgs","repos_url":"https://api.github.com/users/chrispeoples/repos","events_url":"https://api.github.com/users/chrispeoples/events{/privacy}","received_events_url":"https://api.github.com/users/chrispeoples/received_events","type":"User","site_admin":false},"labels":[{"id":467765246,"node_id":"MDU6TGFiZWw0Njc3NjUyNDY=","url":"https://api.github.com/repos/chrispeoples/browser_github_test/labels/lab-automated","name":"lab-automated","color":"0099FF","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-05T18:34:08Z","updated_at":"2018-06-05T18:34:28Z","closed_at":"2018-06-05T18:34:28Z","author_association":"OWNER","body":"### Summary\n\nPlatform: ios\nPackage: com.nowsecure.rvia\n\nTraffic is analyzed to determine if any sensitive data is transmitted insecurely over the network without encryption. For this check, instances of the Last Name were searched across any intercepted traffic.\n\n### Risk and Regulatory information\nSeverity: high\nCVSS: 7.1\n\nCWE: [319](https://cwe.mitre.org/data/definitions/319.html)\nFISMA_LOW: [SC-13 CRYPTOGRAPHIC PROTECTION, AC-22 PUBLICLY ACCESSIBLE CONTENT](http://dx.doi.org/10.6028/NIST.SP.800-53r4)\nFISMA_MED: [SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY](http://dx.doi.org/10.6028/NIST.SP.800-53r4)\nOWASP: [Mobile Top 10: M3-Insecure Communication](https://www.owasp.org/index.php/Mobile_Top_10_2016-M3-Insecure_Communication)\nGDPR: [Risks violating Article 25](https://gdpr-info.eu/art-25-gdpr/), [Risks violating Article 32](https://gdpr-info.eu/art-32-gdpr/)\nFFIEC: [May violate D3.PC.Am.Int.7](https://www.ffiec.gov/pdf/cybersecurity/FFIEC_CAT_May_2017.pdf)\nPCI: [May violate requirement 4.1](https://www.pcisecuritystandards.org/document_library?document=pci_dss)\nHIPAA: [May violate §164.312(e)(1): Standard: Transmission security.](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf?language=es)\nGOOGLE_CAQ: [SC-N1 - All network traffic is sent over SSL.](https://developer.android.com/develop/quality-guidelines/core-app-quality.html)\n\n### Details\nLast Name was intercepted over HTTP traffic. The table below provides the context of how the data was transmitted (plain-text or encoded) and the URL of this violation.\n\n### Recommendation\nEnforce the use of SSL/TLS for all transport channels in which sensitive information, session tokens, or other sensitive data is going to be communicated to a backend API or web service. Properly validate the SSL/TLS certificate to ensure it is signed by a trusted certificate authority (CA) as well as contains the correct hostname. An even more secure approach is to use Certificate Pinning to mitigate the possibility of SSL/TLS weaknesses. Certificate Pinning is making sure the client checks the server's certificate against a known copy of that certificate. Simply bundle your server's certificate inside your application, and make sure any SSL/TLS request first validates that the server's certificate exactly matches the bundle's certificate. For some apps, Certificate Pinning may be impossible to do. If your app allows users to enter in their own domain names to connect to services, then you have no opportunity to embed that certificate. However, if your app is intended to connect to a known server, or set of servers, you have all the information you need to guarantee that client is indeed talking directly to the server and without a man in the middle eavesdropping.\n\nView more details in Lab Automated: [https://lab.nws-stg-west.nowsecure.io/app/ios/com.nowsecure.rvia/assessment/1528223516204](https://lab.nws-stg-west.nowsecure.io/app/ios/com.nowsecure.rvia/assessment/1528223516204)"}}
{"actor":{"display_login":"chrispeoples"}}