[SECURITY ISSUE] react-native-keys insecurely stores encryption cipher and Base64 chunks

[efstathiosntonas]

more info here:

• GHSA-fj44-h6xw-896g

[dougg0k]

Any fix on this? @numandev1

[ashishzopeCG]

@numandev1 any update on this

[dougg0k]

Only way to be certain that the fix work, is if someone check, obviously.

[ashishzopeCG]

@dougg0k I check at my side with changes mentioned in #105 its fixing one of the issue. Another issue reported as below.
Flaw 1: Hardcoded Secrets
The encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary.
Attackers can extract these secrets using basic static analysis tools such as strings or Hopper.

This still needs to fixed to narrow down vulnerabilities to 0

[dougg0k]

Right.

https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5#flaw-1-hardcoded-secrets

https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5#flaw-2-predictable-cipher-generation

[dougg0k]

If someone wants to add keychain support to the native code, it could possibly solve the issue or at least partially.

https://developer.android.com/privacy-and-security/keystore

https://developer.apple.com/documentation/security/storing-keys-in-the-keychain

https://medium.com/@wickramarathna.amal/how-to-handle-sensitive-information-in-mobile-apps-using-keystore-and-keychain-6c6580dbf90c

[ashishzopeCG]

@numandev1

[ngocle2497]

Hi @ashishzopeCG , @dougg0k

I think we need a new JavaScript script to:

• Generate password:

  • Slice it into 5–10 parts and store each part in C++.

  • Each part should be placed in a separate C++ function with a random function name.

  • Add more dummy/trash functions in C++ to make it harder to identify the real ones.

• Generate cipher text:

  • Use the same strategy as password generation.

• Main function: This should call the actual (true) functions to reconstruct and return the key and password.

[ngocle2497]

@dougg0k this should be fixed on PR

[dougg0k]

Hm, a new release is needed then and confirmation from someone or whoever reported the vulnerability.

@ngocle2497 @numandev1