Bug #22300: [External Audit Findings][Android] Certificate files hardcoded inside the app - VELO Production Issue - S-MADP Customer Support & Information Center

Bug #22300

[External Audit Findings][Android] Certificate files hardcoded inside the app

Added by yap chekying 2 months ago. Updated about 1 month ago.

Status:

Closed

Start date:

29 July 2025

Priority:

Normal

Due date:

Assignee:

yap chekying

% Done:

100%

Category:

Spent time:

Target version:

Description

Issue:
SSL Pinning is a security mechanism used to prevent man-in-the-middle attacks by validating the certificate of a trusted server during the SSL handshake. Developers store a list of trusted certificates within the app and use them to compare against the server certificate. Improper SSL Pinning implementation can make the app vulnerable to man-in-the-middle attacks if the certificate list is hardcoded and outdated.

Recommendation from pentester:
Developers are advised to add obfuscation to make decompilation difficult and to use public keys as variables to make reverse engineering difficult for attackers.

Please refer to attached excel for details.

Copy of Audit Findings - Silver lake - ver2.xlsx (5.15 MB) yap chekying, 29 July 2025 10:03 AM

RE OCBC Business Mobile app Audit Findings - July 2025.msg (364 KB) yap chekying, 06 August 2025 11:07 AM

History

#1 Updated by yap chekying 2 months ago

Subject changed from [External Audit][Android] Certificate files hardcoded inside the app to [External Audit Findings][Android] Certificate files hardcoded inside the app

#2 Updated by Hao Ter Tai 2 months ago

Assignee changed from Hao Ter Tai to Abdul Halim Baharom

#3 Updated by Hao Ter Tai 2 months ago

% Done changed from 0 to 50

238,044
30/7/2025 Bug #22300 [External Audit Findings][Android] Certificate files hardcoded inside the app

Solution:
Remove cert and add encrypted cert. Add logic to read the encrypted cert

Note:
commit to trunk

#4 Updated by Hao Ter Tai about 2 months ago

Assignee changed from Abdul Halim Baharom to Hao Ter Tai
% Done changed from 50 to 90

238,072
1–8-2025 Bug #22300 [External Audit Findings][Android] Certificate files hardcoded inside the app
Issue:
SSL Pinning is a security mechanism used to prevent man-in-the-middle attacks by validating the certificate of a trusted server during the SSL handshake. Developers store a list of trusted certificates within the app and use them to compare against the server certificate. Improper SSL Pinning implementation can make the app vulnerable to man-in-the-middle attacks if the certificate list is hardcoded and outdated.

Solution:
Update SSL pinning for UAT and PROD