{"action":"opened","issue":{"url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/569","repository_url":"https://api.github.com/repos/chrispeoples/browser_github_test","labels_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/569/labels{/name}","comments_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/569/comments","events_url":"https://api.github.com/repos/chrispeoples/browser_github_test/issues/569/events","html_url":"https://github.com/chrispeoples/browser_github_test/issues/569","id":380819467,"node_id":"MDU6SXNzdWUzODA4MTk0Njc=","number":569,"title":"Lab Automated dynamic analysis: Sensitive Data: Password (Local Files)","user":{"login":"chrispeoples","id":22162665,"node_id":"MDQ6VXNlcjIyMTYyNjY1","avatar_url":"https://avatars0.githubusercontent.com/u/22162665?v=4","gravatar_id":"","url":"https://api.github.com/users/chrispeoples","html_url":"https://github.com/chrispeoples","followers_url":"https://api.github.com/users/chrispeoples/followers","following_url":"https://api.github.com/users/chrispeoples/following{/other_user}","gists_url":"https://api.github.com/users/chrispeoples/gists{/gist_id}","starred_url":"https://api.github.com/users/chrispeoples/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrispeoples/subscriptions","organizations_url":"https://api.github.com/users/chrispeoples/orgs","repos_url":"https://api.github.com/users/chrispeoples/repos","events_url":"https://api.github.com/users/chrispeoples/events{/privacy}","received_events_url":"https://api.github.com/users/chrispeoples/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-14T18:00:03Z","updated_at":"2018-11-14T18:00:03Z","closed_at":null,"author_association":"OWNER","body":"### Summary\n\nPlatform: android\nPackage: com.optimum.unity.mobile\n\nLocal application files and external storage locations are inpected for sensitive user/application data. For this check, instances of thePassword were searched.\n\n### Risk and Regulatory information\nSeverity: medium\nCVSS: 4.4\n\nCWE: [312](https://cwe.mitre.org/data/definitions/312.html)\nFISMA_MED: [SC-28 PROTECTION OF INFORMATION AT REST](http://dx.doi.org/10.6028/NIST.SP.800-53r4)\nOWASP: [Mobile Top 10: M2-Insecure Data Storage](https://www.owasp.org/index.php/Mobile_Top_10_2016-M2-Insecure_Data_Storage)\nGDPR: [Risks violating Article 25](https://gdpr-info.eu/art-25-gdpr/), [Risks violating Article 32](https://gdpr-info.eu/art-32-gdpr/)\nFFIEC: [May violate D3.PC.Am.A.1](https://www.ffiec.gov/pdf/cybersecurity/FFIEC_CAT_May_2017.pdf)\nPCI: [May violate requirement 3.1 through 3.4](https://www.pcisecuritystandards.org/document_library?document=pci_dss)\nHIPAA: [May violate §164.312(a)(1): Standard: Access control.](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf?language=es)\n\n### Details\nPassword has been found within local application folders or external storage locations on the device. You can review the output below to see where each instance was found.\n\n### Recommendation\nSensitive data should be transmitted and displayed but not persisted to memory. This is typically achieved by storeing sensitive data in RAM (clear at application close) or encrypting the data using strong encryption. It is also important to note that external storage such as SD Card has no fine grained permissions and that any app by default has read access to the storage and can read all files. Since Android 4.4 apps can store data on the SD Card in a protected way under certain circumstances [see [http://source.android.com/devices/tech/storage/](http://source.android.com/devices/tech/storage/)].\n\nView more details in Lab Automated: [https://lab.nws-stg-west.nowsecure.io/app/android/com.optimum.unity.mobile/assessment/915343](https://lab.nws-stg-west.nowsecure.io/app/android/com.optimum.unity.mobile/assessment/915343)"}}
{"actor":{"display_login":"chrispeoples"}}