AndroidCareProvider - Security Audit Report¶

// MySharedPreferences.java - Lines 264, 583
public void SetPassword(String Password) {
    editor.putString(this.Password, Password);
    editor.commit();  // ❌ Stored in plain text
}

public String GetPassword() {
    return prefs.getString(Password, "");  // ❌ Retrieved in plain text
}

public void SetUserName(String UserName) {
    editor.putString(this.UserName, UserName);
    editor.commit();  // ❌ Stored in plain text
}

// CalendarCustomView.java - Line 2564
password = URLEncoder.encode(mpref.GetPassword(), "UTF-8");

// CalendarCustomView.java - Line 2571
+ "&password=" + password + "&lang=" + Language  // ❌ Password in URL

// Use Android Keystore + EncryptedSharedPreferences
import androidx.security.crypto.EncryptedSharedPreferences
import androidx.security.crypto.MasterKey

val masterKey = MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build()

val encryptedPrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)

// Store password (or preferably, don't store it at all)
encryptedPrefs.edit()
    .putString("password", password)
    .apply()

// Line 568 - Authentication claim token stored unencrypted
public void SetAuthClaimToken(String claimToken) {
    editor.putString(KEY_CLAIM_TOKEN, claimToken);
    editor.commit();  // ❌ No encryption
}

// Line 194 - User login object (likely contains JWT)
public void SetUserLoginObj(String UserLoginObj) {
    editor.putString(this.UserLoginObj, UserLoginObj);
    editor.commit();  // ❌ No encryption
}

class SessionManager(private val context: Context) {
    private val TIMEOUT_DURATION = 15 * 60 * 1000L // 15 minutes
    private var lastActivityTime = System.currentTimeMillis()

    fun updateActivity() {
        lastActivityTime = System.currentTimeMillis()
    }

    fun isSessionExpired(): Boolean {
        return (System.currentTimeMillis() - lastActivityTime) > TIMEOUT_DURATION
    }

    fun enforceTimeout() {
        if (isSessionExpired()) {
            clearSession()
            navigateToLogin()
        }
    }
}

// WebAPICall.java - Line 33
eUniversityClient.get("authenticate/?username=qauser14&password=123", null, 
    new JsonHttpResponseHandler() {
        // ❌ Hardcoded test credentials in production code
    });

// Line 2584
filter.put("AccessToken", "F8949358-1948-4512-9065-ADA9CAFF42DF");  
// ❌ Hardcoded token in source code

// Personal Identifiable Information
final String FirstName = "FirstName";           // ❌ Unencrypted
final String LastName = "LastName";             // ❌ Unencrypted
final String DOB = "DOB";                       // ❌ Unencrypted (Date of Birth)
final String Gender = "Gender";                 // ❌ Unencrypted
final String user_id = "userid";                // ❌ Unencrypted
final String UserName = "UserName";             // ❌ Unencrypted
final String Password = "Password";             // ❌ CRITICAL: Plain text password
final String ImagePath = "ImagePath";           // ❌ Profile photo path
final String UserLoginObj = "UserLoginObj";     // ❌ Full user object (JSON)
final String DeviceID = "DeviceID";             // ❌ Device identifier

// Use EncryptedSharedPreferences for all PHI
import androidx.security.crypto.EncryptedSharedPreferences

object SecurePreferences {
    private lateinit var encryptedPrefs: SharedPreferences

    fun init(context: Context) {
        val masterKey = MasterKey.Builder(context)
            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
            .build()

        encryptedPrefs = EncryptedSharedPreferences.create(
            context,
            "encrypted_prefs",
            masterKey,
            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
        )
    }

    fun saveUserData(userJson: String) {
        encryptedPrefs.edit()
            .putString("user_data", userJson)
            .apply()
    }
}

// Use SQLCipher for database encryption
dependencies {
    implementation 'net.zetetic:android-database-sqlcipher:4.5.4'
}

// Initialize encrypted database
val passphrase = SQLiteDatabase.getBytes("your_secure_key".toCharArray())
val database = SQLiteDatabase.openOrCreateDatabase(databaseFile, passphrase, null)

// Line 92
prefs = ctx.getSharedPreferences("", ctx.MODE_PRIVATE);
// ❌ MODE_PRIVATE provides process isolation only, not encryption

<!-- AndroidManifest.xml -->
<application
    android:allowBackup="false"
    android:fullBackupContent="@xml/backup_rules"
    ...>

<!-- res/xml/backup_rules.xml -->
<full-backup-content>
    <exclude domain="sharedpref" path="secure_prefs.xml"/>
    <exclude domain="database" path="."/>
</full-backup-content>

// MyFirebaseMessagingService.java - Line 46
public static final String imageBaseURL = "http://team-server.innotech-sa.com/Psyter/PsyterAPI";
// ❌ HTTP (not HTTPS) - completely unencrypted

<!-- res/xml/network_security_config.xml -->
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">webapis.psyter.com</domain>
        <pin-set expiration="2026-12-31">
            <!-- SHA-256 hash of certificate public key -->
            <pin digest="SHA-256">base64==</pin>
            <!-- Backup pin -->
            <pin digest="SHA-256">backupbase64==</pin>
        </pin-set>
    </domain-config>
</network-security-config>

<!-- AndroidManifest.xml -->
<application
    android:networkSecurityConfig="@xml/network_security_config"
    ...>

// Lines 222-225 (Production)
BaseURLS.BaseURL = "https://webapis.psyter.com/";
BaseURLS.BaseURLVideo = "https://webapis.psyter.com";
BaseURLS.BaseURLScheduling = "http://scheduling.innotech-sa.com/SchedulingAPI/";
BaseURLS.BaseURLPayment = "https://www.psyter.com/Client/BookingPayment?";

// Lines 232-235 (Development)
BaseURLS.BaseURL = "http://team-server.innotech-sa.com/Psyter/PsyterAPI/";
BaseURLS.BaseURLVideo = "http://team-server.innotech-sa.com/Psyter/PsyterAPI";
BaseURLS.BaseURLScheduling = "https://dev2.innotech-sa.com/Scheduling/SchedulingAPI/api/";
BaseURLS.BaseURLPayment = "https://team-server.innotech-sa.com/Psyter/PsyterWeb/Client/BookingPayment?";

// Use remote config (Firebase Remote Config)
val remoteConfig = Firebase.remoteConfig

remoteConfig.fetchAndActivate()
    .addOnCompleteListener { task ->
        if (task.isSuccessful) {
            BaseURLS.BaseURL = remoteConfig.getString("api_base_url")
            BaseURLS.BaseURLVideo = remoteConfig.getString("video_api_url")
        }
    }

// WebAPICall.java - Line 54
private static final String BASE_URL = "http://192.168.1.34/eUniversityWebAPI/user/";
// ❌ Internal network IP address exposed

// BaseCarePActivityMain.java - Line 179
private String mURL = "http://live.innotech-sa.com/share/Quran/test_img.jpg";
// ❌ Internal server hostname

// Line 36
//settings.setJavaScriptEnabled(true);  // ❌ Commented but dangerous if uncommented

// Enable JavaScript only if absolutely necessary
WebSettings settings = webView.getSettings();
settings.setJavaScriptEnabled(false);  // Disable by default

// If required, enable with strict content security
settings.setJavaScriptEnabled(true);
settings.setAllowFileAccess(false);
settings.setAllowContentAccess(false);
settings.setAllowFileAccessFromFileURLs(false);
settings.setAllowUniversalAccessFromFileURLs(false);

// If using JavaScript interface, validate origin
webView.addJavascriptInterface(new WebAppInterface(this), "Android");

val okHttpClient = OkHttpClient.Builder()
    .connectTimeout(10, TimeUnit.SECONDS)
    .readTimeout(30, TimeUnit.SECONDS)
    .writeTimeout(30, TimeUnit.SECONDS)
    .build()

import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties

object CryptoUtils {
    private const val TRANSFORMATION = "AES/GCM/NoPadding"
    private const val ANDROID_KEYSTORE = "AndroidKeyStore"

    fun encrypt(data: ByteArray, secretKey: SecretKey): ByteArray {
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.ENCRYPT_MODE, secretKey)
        val iv = cipher.iv
        val encrypted = cipher.doFinal(data)
        return iv + encrypted  // Prepend IV to encrypted data
    }

    fun decrypt(encryptedData: ByteArray, secretKey: SecretKey): ByteArray {
        val cipher = Cipher.getInstance(TRANSFORMATION)
        val iv = encryptedData.sliceArray(0 until 12)
        val encrypted = encryptedData.sliceArray(12 until encryptedData.size)
        val spec = GCMParameterSpec(128, iv)
        cipher.init(Cipher.DECRYPT_MODE, secretKey, spec)
        return cipher.doFinal(encrypted)
    }
}

// Client/Fragments/MainFragmentClient.java - Line 61
Log.d("FIREBASE_TOKEN", Utility.getFirebaseInstanceId(getContext()));
// ❌ Firebase token logged in plain text

// Custom logger that strips sensitive data in release builds
object SecureLogger {
    fun d(tag: String, message: String) {
        if (BuildConfig.DEBUG) {
            Log.d(tag, sanitize(message))
        }
    }

    private fun sanitize(message: String): String {
        return message
            .replace(Regex("token=\\S+"), "token=***")
            .replace(Regex("password=\\S+"), "password=***")
            .replace(Regex("api_key=\\S+"), "api_key=***")
    }
}

# Remove all Log.d/v/i calls in release builds
-assumenosideeffects class android.util.Log {
    public static *** d(...);
    public static *** v(...);
    public static *** i(...);
}

# Current file is mostly empty/default
# No custom obfuscation rules
# No reflection protection

# Aggressive obfuscation
-optimizationpasses 5
-dontusemixedcaseclassnames
-dontskipnonpubliclibraryclasses
-dontpreverify
-verbose

# Obfuscate package names
-repackageclasses 'com.psyter.obf'
-allowaccessmodification

# Remove debugging info
-assumenosideeffects class android.util.Log {
    public static *** d(...);
    public static *** v(...);
}

# Protect sensitive classes
-keep class com.psyter.www.Stats.MySharedPreferences {
    <init>(...);
    public void Set*(...);
    public *** Get*();
}

# String encryption (external plugin)
# https://github.com/MichaelRocks/paranoid
-apply mapping string-obfuscation.txt

// MyFirebaseInstanceIdService.java - Lines 19-51 (entire service commented)
//    public void onNewToken(@NonNull String s) {
//            String CurrentToken = FirebaseInstanceId.getInstance().getToken();
//            ...
//    }

// ViewDocWebActivity.java - Line 36
//settings.setJavaScriptEnabled(true);

// Verify APK signature at runtime
fun verifySignature(context: Context): Boolean {
    val packageInfo = context.packageManager.getPackageInfo(
        context.packageName, 
        PackageManager.GET_SIGNATURES
    )
    val signature = packageInfo.signatures[0]
    val expectedSignature = "YOUR_RELEASE_SIGNATURE_HASH"

    return signature.toCharsString().hashCode().toString() == expectedSignature
}

// Upgrade vulnerable dependencies
implementation 'com.google.code.gson:gson:2.10.1'  // Was: 2.8.2/2.8.5

// Remove unmaintained library
// implementation 'com.loopj.android:android-async-http:1.4.9'  // DELETE

// Use maintained alternative
implementation 'com.squareup.retrofit2:retrofit:2.9.0'
implementation 'com.squareup.okhttp3:okhttp:4.12.0'

# Run dependency vulnerability scan
./gradlew dependencyCheckAnalyze

{
  "api_key": [
    {
      "current_key": "AIzaSyDKkHZSXDXz_PUNWPUS8YBWMTGl7kQzH44"
    }
  ],
  "client_id": "323110683165-bh4bt0ecrh8u2sbbrvjd592262mokm3d.apps.googleusercontent.com"
}

# Add Firebase API key restrictions in Firebase Console:
# 1. Go to APIs & Services > Credentials
# 2. Select API key
# 3. Add application restrictions (Android app SHA-1 fingerprint)
# 4. Add API restrictions (limit to specific Firebase APIs)

<!-- AndroidManifest.xml -->
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>  
<!-- ❌ High privacy risk, requires strong justification -->

<uses-permission android:name="android.permission.GET_ACCOUNTS"/>
<!-- ❌ Deprecated in Android 8.0+, should be removed -->

// Request permissions with rationale
if (ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA) 
    != PackageManager.PERMISSION_GRANTED) {

    if (ActivityCompat.shouldShowRequestPermissionRationale(this, 
        Manifest.permission.CAMERA)) {
        // Show explanation dialog
        AlertDialog.Builder(this)
            .setMessage("Camera access is required for video consultations")
            .setPositiveButton("OK") { _, _ ->
                ActivityCompat.requestPermissions(this, 
                    arrayOf(Manifest.permission.CAMERA), 
                    REQUEST_CAMERA)
            }
            .show()
    } else {
        ActivityCompat.requestPermissions(this, 
            arrayOf(Manifest.permission.CAMERA), 
            REQUEST_CAMERA)
    }
}

// Email validation
fun isValidEmail(email: String): Boolean {
    return android.util.Patterns.EMAIL_ADDRESS.matcher(email).matches()
}

// Phone validation
fun isValidPhone(phone: String): Boolean {
    return phone.matches(Regex("^\\+?[1-9]\\d{1,14}$"))
}

// Sanitize HTML input
fun sanitizeInput(input: String): String {
    return HtmlCompat.fromHtml(input, HtmlCompat.FROM_HTML_MODE_LEGACY).toString()
}

class RateLimiter(private val maxRequests: Int, private val timeWindow: Long) {
    private val requests = mutableListOf<Long>()

    fun allowRequest(): Boolean {
        val now = System.currentTimeMillis()
        requests.removeAll { it < now - timeWindow }

        return if (requests.size < maxRequests) {
            requests.add(now)
            true
        } else {
            false
        }
    }
}

// Usage
val loginRateLimiter = RateLimiter(maxRequests = 5, timeWindow = 60_000) // 5 per minute

fun attemptLogin(username: String, password: String) {
    if (!loginRateLimiter.allowRequest()) {
        showError("Too many login attempts. Please try again later.")
        return
    }
    // Proceed with login
}

# Static analysis
./gradlew dependencyCheckAnalyze  # Vulnerability scanning
./gradlew sonarqube              # Code quality + security

# Reverse engineering
apktool d app-release.apk        # Decompile APK
jadx-gui app-release.apk         # View Java source

# Runtime analysis
frida -U -f com.psyter.www       # Dynamic instrumentation
objection -g com.psyter.www explore  # Runtime mobile security

// Encryption
implementation 'androidx.security:security-crypto:1.1.0-alpha06'

// Network security
implementation 'com.squareup.okhttp3:okhttp:4.12.0'
implementation 'com.squareup.okhttp3:okhttp-tls:4.12.0'

// Certificate pinning
implementation 'com.github.appmattus.certificatetransparency:certificatetransparency-android:2.2.0'

// ProGuard/R8 optimization
implementation 'com.guardsquare:proguard-gradle:7.4.1'