Appicaptor Changelog – May 2016

Analysis of Cryptographic Weaknesses
Due to the critical findings in numerous manual app analyzes, we have included additional test cases for cryptographic weaknesses in Appicaptor. Appicaptor now detects the usage of static values ​​that should not be integrated into an app. This includes static cryptographic keys as well as cryptographic random generators with fixed seed values, which makes it very easy for attackers to break the encryption. In addition, static initialization vectors are detected in block ciphering, as this allows the attacker to draw conclusions about segments of encrypted messages.

App Classification
The classification of apps with their described main function enables the security-relevant evaluation of the detected app properties. In the current Appicaptor version, we have further optimized the classification using the app description text. In addition, two new app types were added to the classification of apps. The new app type ImageCreator combines apps to create and edit images in a function model, and the type AudioProcessing allows you to specifically evaluate apps that process audio data.

In addition, the Appicaptor Web Interface now allows you to set an app type when uploading app binaries. Thus also for these apps the possibility of a specific evaluation of the app properties by the set app type exists. Existing, already uploaded app binaries are still evaluated with the type Generic and can be re-uploaded with the desired specific app type.

Appicaptor Changelog- January 2016

Analysis of App Developments
It is possible to analyze apps that are not (yet) available in the App markets. All Appicaptor users with with an Appicaptor Corporate subscription can use the updated Appicaptor Web Interface functionality found at the menu item “Orders” and the new menu item “Upload binary App”. For more details refer to the updated Appicaptor Quick Start Guide.

Enhanced Analysis Scope
Additional security-relevant app properties are now detected and evaluated. For iOS apps, for example, the different extensions are displayed (app extensions e.g.: Document Picker, Watch App, etc.). Those functions can be used by other apps without the execution source app that the extension makes available. An extension can gain access to user-related data, in the name of other app as well as through shared resources in the name of the source app. As a result, confidential corporate data may be passed to untrustworthy apps.

Changes to Appicaptor Subscriptions
All companies with (existing) Appicaptor Top Free subscriptions receive an additional user account per app platform, in order to make it easier to create deputy processes. In addition, there is now the possibility of a weekly test cycle of 25 apps with the Appicaptor Starter Corporate Weekly subscription as an alternative to the monthly test cycle.