cyberaudit-skill 3.0.0

package/skills/cyberaudit/mobile/MOBILE-THREAT-MODELS.md

@@ -0,0 +1,279 @@
+# 🎯 MOBILE THREAT MODELS — CYBERAUDIT SKILL
+# Comprehensive threat models for mobile applications
+
+═══════════════════════════════════════════════════════════════
+              STRIDE APPLIED TO MOBILE
+═══════════════════════════════════════════════════════════════
+
+S — SPOOFING
+  Specific mobile threats:
+  → Fake app on third-party stores (APK sideloading)
+  → Certificate spoofed via compromised CA (without pinning)
+  → Deep link hijacking (another app intercepts the link)
+  → Intent spoofing (Android: implicit intents intercepted)
+  → Biometrics bypassed via Frida hook
+  
+  Controls:
+  → Mandatory certificate pinning
+  → Explicit intents for internal communication
+  → App signature verification
+  → Biometrics linked to a cryptographic key
+
+T — TAMPERING
+  Specific mobile threats:
+  → Binary modification APK/IPA (repackaging)
+  → Hooking via Frida to modify behavior
+  → Man-in-the-Middle on network traffic
+  → Modification of SharedPreferences/plist files
+  → Code injection via WebView bridge
+  
+  Controls:
+  → Binary integrity verification
+  → Anti-hooking / anti-Frida
+  → Certificate pinning
+  → Secure storage with integrity
+
+R — REPUDIATION
+  Specific mobile threats:
+  → Sensitive actions without audit trail server-side
+  → Transactions without cryptographic proof
+  → Insufficient logs for forensic after incident
+  
+  Controls:
+  → Server-side logging of all sensitive actions
+  → Signature of critical transactions
+  → Server timestamps (not client)
+
+I — INFORMATION DISCLOSURE
+  Specific mobile threats:
+  → AsyncStorage/SharedPreferences read on rooted device
+  → Unencrypted ADB backup
+  → Screenshots in app switcher
+  → Logs accessible via ADB logcat
+  → Binary strings extracted from APK/IPA
+  → Memory dumps on rooted device
+  → Unencrypted traffic intercepted
+  → Data in clipboard
+  → Sensitive data in crash reports
+  
+  Controls:
+  → Mandatory Keychain/Keystore
+  → allowBackup=false or backup rules
+  → Screenshot protection
+  → Conditional logs in dev only
+  → Secrets outside binary
+  → Memory protection for sensitive data
+
+D — DENIAL OF SERVICE
+  Specific mobile threats:
+  → Battery drain via excessive network requests
+  → Storage exhaustion via uploads
+  → CPU exhaustion via unlimited cryptographic operations
+  → App crash via malformed deep link
+  → Crash via malformed JSON payload in WebView bridge
+  
+  Controls:
+  → Timeout on all network requests
+  → Input validation before heavy processing
+  → Server-side rate limiting
+  → Exception handling on deep links
+
+E — ELEVATION OF PRIVILEGE
+  Specific mobile threats:
+  → Root access exploited to read other apps' data
+  → Exported Content Provider giving access to internal data
+  → Exported Activity allowing access to admin functions
+  → Privilege escalation via WebView → JavaScript Bridge → Native
+  
+  Controls:
+  → Components not exported by default
+  → Permissions on exported components
+  → Minimal WebView bridge
+
+═══════════════════════════════════════════════════════════════
+              MOBILE ATTACK TREES
+═══════════════════════════════════════════════════════════════
+
+TREE 1 — AUTH TOKEN COMPROMISE
+────────────────────────
+
+  OBJECTIVE: Steal the authentication token
+  │
+  ├── VECTOR A: Extraction from storage
+  │   ├── A1: Rooted device → read AsyncStorage directly
+  │   │         Prerequisite: root, physical access
+  │   │         Ease: EASY if AsyncStorage
+  │   │
+  │   ├── A2: Unencrypted ADB backup
+  │   │         Prerequisite: ADB enabled OR cloud backup
+  │   │         Ease: EASY if allowBackup=true
+  │   │
+  │   └── A3: Memory dump (app in foreground)
+  │             Prerequisite: root + tools
+  │             Ease: MEDIUM
+  │
+  ├── VECTOR B: Network interception
+  │   ├── B1: MitM on public WiFi (without pinning)
+  │   │         Prerequisite: same network
+  │   │         Ease: EASY with mitmproxy
+  │   │
+  │   └── B2: Malicious CA installed (without pinning)
+  │             Prerequisite: physical access to device
+  │             Ease: MEDIUM
+  │
+  └── VECTOR C: Binary extraction
+      ├── C1: Token hardcoded in JS bundle
+      │         Prerequisite: APK downloaded
+      │         Ease: VERY EASY
+      │
+      └── C2: Dev endpoint exposed in prod
+                Prerequisite: knowledge of endpoint
+                Ease: EASY
+
+TREE 2 — MOBILE ACCOUNT TAKEOVER
+────────────────────────────────────
+
+  OBJECTIVE: Take control of an account
+  │
+  ├── VECTOR A: Session theft (see tree 1)
+  │
+  ├── VECTOR B: Biometrics bypass
+  │   ├── B1: Frida hook on verification method
+  │   │         Prerequisite: root + Frida
+  │   │         Ease: EASY if client-side only check
+  │   │
+  │   └── B2: Biometrics = just a boolean flag
+  │             Prerequisite: root or decompilation
+  │             Ease: EASY if poorly implemented
+  │
+  ├── VECTOR C: Malicious deep link
+  │   └── C1: Forged link that triggers an auth action
+  │             Prerequisite: unvalidated deep link
+  │             Ease: EASY
+  │
+  └── VECTOR D: Mobile API exploitation
+      └── D1: IDOR on mobile endpoint (predictable IDs)
+                Prerequisite: valid account
+                Ease: MEDIUM
+
+TREE 3 — LOCAL DATA EXFILTRATION
+──────────────────────────────────────────
+
+  OBJECTIVE: Read another user's data
+  │
+  ├── VECTOR A: Physical access + root
+  │   └── A1: Direct read of unencrypted storage
+  │             Ease: VERY EASY if unencrypted
+  │
+  ├── VECTOR B: Backup extraction
+  │   ├── B1: ADB backup (Android)
+  │   └── B2: iTunes/iCloud backup (iOS)
+  │             Ease: EASY if not excluded
+  │
+  └── VECTOR C: Malware / malicious app
+      └── C1: Intent sniffing (Android)
+                Unprotected Content Provider
+                Ease: MEDIUM
+
+═══════════════════════════════════════════════════════════════
+              THREAT MODELS BY MOBILE APP TYPE
+═══════════════════════════════════════════════════════════════
+
+BANKING / FINTECH APP
+──────────────────────
+  Priority 1: Token theft → fraudulent transactions
+  Priority 2: MitM → amount manipulation
+  Priority 3: Root/jailbreak → protection bypass
+  Priority 4: Repackaging → fake app for phishing
+  Priority 5: Screen recording during transactions
+  
+  Mandatory controls:
+  → Certificate pinning with backup pin
+  → Root/Jailbreak detection
+  → Keystore with StrongBox (Android)
+  → Biometrics linked to cryptographic key
+  → Transaction signing server-side
+  → Business code obfuscation
+  → Anti-Frida/anti-debug
+
+HEALTH APP
+──────────────────────
+  Priority 1: Access to other patients' medical data
+  Priority 2: Cleartext data in backups
+  Priority 3: Logs containing health data
+  Priority 4: Data in crash reports
+  Priority 5: Access without re-authentication
+  
+  Mandatory controls:
+  → Encryption of entire local database
+  → Backup exclusion
+  → Crash report filtering
+  → Re-auth for access to sensitive data
+  → HIPAA compliance
+
+E-COMMERCE APP
+──────────────────────
+  Priority 1: Card data theft (if stored)
+  Priority 2: Account takeover → fraudulent purchase
+  Priority 3: Client-side price manipulation
+  Priority 4: Coupon/promo abuse via race condition
+  Priority 5: Personal data (GDPR)
+  
+  Mandatory controls:
+  → NEVER store card data locally
+  → Use payment SDK (Stripe, etc.)
+  → Server-side price validation only
+  → Rate limiting on purchases
+
+GENERAL PUBLIC APP
+──────────────────────
+  Priority 1: Exposed personal data
+  Priority 2: Account takeover
+  Priority 3: Abusive permissions
+  Priority 4: Overly invasive analytics
+  Priority 5: Unvalidated deep links
+
+═══════════════════════════════════════════════════════════════
+              MOBILE KILL CHAINS
+═══════════════════════════════════════════════════════════════
+
+MOBILE KILL CHAIN 1 — TOKEN THEFT VIA BACKUP
+  1. Application with allowBackup="true" (Android default)
+  2. Attacker with temporary physical access to device
+  3. adb backup -apk com.yourapp ./backup.ab
+  4. Extraction: android-backup-extractor + tar
+  5. Reading: /data/data/com.yourapp/
+                  shared_prefs/asyncstorage.xml
+  6. Cleartext token → account access
+
+MOBILE KILL CHAIN 2 — MITM VIA PROXY
+  1. Application without certificate pinning
+  2. Attacker on same WiFi network
+  3. Install mitmproxy + CA on device (if user allows)
+  4. Intercept all API calls
+  5. Steal Bearer token from headers
+  6. Replay token → account access
+
+MOBILE KILL CHAIN 3 — BINARY SECRET EXTRACTION
+  1. Download APK (from device or third-party stores)
+  2. apktool d app.apk (decompilation)
+  3. grep -r "API_KEY\|secret\|password\|token" ./
+  4. Secrets found in cleartext in index.android.bundle
+  5. Use secrets to access infrastructure
+
+MOBILE KILL CHAIN 4 — DEEP LINK INJECTION
+  1. Application with poorly validated deep link
+     myapp://transfer?amount=100&to=victim
+  2. Attacker creates link:
+     myapp://transfer?amount=9999&to=attacker
+  3. Victim clicks link (SMS, email, QR code)
+  4. App opens and executes transfer without validation
+  5. Money transferred to attacker's account
+
+MOBILE KILL CHAIN 5 — FRIDA RUNTIME MANIPULATION
+  1. Rooted device with Frida installed
+  2. Attack on biometric verification:
+     frida -U -n com.yourapp -s bypass_biometric.js
+  3. Hook on verification method → always returns true
+  4. Access to biometric-protected features
+  5. Data extraction or execution of sensitive actions

package/skills/cyberaudit/mobile/frameworks/EXPO.md

@@ -0,0 +1,247 @@
+# 🚀 EXPO — SECURITY AUDIT GUIDE
+# Comprehensive audit guide for Expo / Expo Router applications
+
+═══════════════════════════════════════════════════════════════
+              EXPO — TWO MODES, TWO RISK MODELS
+═══════════════════════════════════════════════════════════════
+
+EXPO MANAGED WORKFLOW
+──────────────────────
+  → Expo handles native for you
+  → Advantage: simplicity
+  → Security risk: limited native modules
+  
+  IMPLICATIONS:
+  → Keychain/Keystore via expo-secure-store only
+  → Certificate pinning difficult in managed
+  → No custom native modules
+  → Expo Go = additional attack surface in dev
+
+EXPO BARE WORKFLOW
+──────────────────────
+  → Full access to native code
+  → Same security model as pure React Native
+  → All React Native fixes apply
+
+EXPO GO (DEVELOPMENT ONLY)
+────────────────────────────────────
+  ⚠️ EXPO GO MUST NEVER BE USED IN PRODUCTION
+  → Expo Go can load any app via QR code
+  → App secrets can be exposed
+  → No certificate pinning possible in Expo Go
+
+OTA UPDATES (EXPO UPDATES)
+────────────────────────────
+  → Expo allows Over-The-Air updates of the JS bundle
+  → CRITICAL RISK: if the OTA channel is compromised,
+    malicious code can be deployed to all devices
+  → Verify: separate channels (dev/staging/prod)
+  → Verify: update signing configured
+
+═══════════════════════════════════════════════════════════════
+              VULNERABLE EXPO PATTERNS
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EXPO SECURE STORE — CORRECT USAGE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+CRITICAL PATTERN 1 — AsyncStorage instead of SecureStore
+  DETECT:
+    import AsyncStorage from '@react-native-async-storage/async-storage'
+    await AsyncStorage.setItem('token', authToken)
+  
+  FIX:
+    import * as SecureStore from 'expo-secure-store'
+    
+    // expo-secure-store uses:
+    // iOS → Keychain Services
+    // Android → EncryptedSharedPreferences (API 23+)
+    
+    const TOKEN_KEY = 'auth_token'
+    
+    // Store
+    await SecureStore.setItemAsync(TOKEN_KEY, token, {
+      keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+      // WHEN_UNLOCKED_THIS_DEVICE_ONLY:
+      // - Device must be unlocked to read
+      // - Not in iCloud backups
+      // - Bound to physical device
+    })
+    
+    // Read
+    const token = await SecureStore.getItemAsync(TOKEN_KEY)
+    
+    // Delete
+    await SecureStore.deleteItemAsync(TOKEN_KEY)
+    
+    // ⚠️ LIMITATION: expo-secure-store has a size limit
+    // Store only tokens, not large objects
+    // For larger data:
+    // Encrypt with a key stored in SecureStore
+    // then store encrypted data in AsyncStorage
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EXPO ENVIRONMENT VARIABLES
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+CRITICAL PATTERN 2 — Secrets in app.config.js / app.json
+  DETECT:
+    // app.config.js
+    export default {
+      extra: {
+        apiKey: 'sk-abc123...', // CRITICAL: in the bundle!
+        dbPassword: 'secret',
+        stripeKey: 'sk_live_...',
+      }
+    }
+    
+    // app.json
+    {
+      "expo": {
+        "extra": {
+          "apiKey": "sk-abc123..." // CRITICAL
+        }
+      }
+    }
+  
+  UNDERSTAND:
+    expo.extra is embedded in the app's JS bundle.
+    Accessible via Constants.expoConfig.extra
+    = visible in decompiled bundle
+    = visible in Expo Go
+  
+  FIX:
+    // app.config.js — Read from CI/CD environment
+    export default {
+      extra: {
+        // ✅ Public key (not secret)
+        apiUrl: process.env.EXPO_PUBLIC_API_URL,
+        // EXPO_PUBLIC_ variables are injected into the bundle
+        // Use ONLY for public values
+        
+        // ❌ Do NOT put here:
+        // apiSecret, dbPassword, privateKey, etc.
+      }
+    }
+    
+    // Real secret keys stay server-side.
+    // The mobile app should NOT have secrets.
+    // It authenticates against a backend
+    // which has access to the secrets.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EXPO UPDATES — OTA SECURITY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+HIGH PATTERN 3 — Poorly configured OTA channels
+  DETECT in app.config.js:
+    updates: {
+      url: 'https://u.expo.dev/...',
+      // No channel configuration
+      // No signature verification
+    }
+  
+  FIX:
+    // app.config.js
+    updates: {
+      url: 'https://u.expo.dev/YOUR-PROJECT-ID',
+      enabled: true,
+      checkAutomatically: 'ON_LOAD',
+      fallbackToCacheTimeout: 0,
+      codeSigningCertificate: './code-signing/certificate.pem',
+      codeSigningMetadata: {
+        keyid: 'main',
+        alg: 'rsa-v1_5-sha256',
+      },
+    },
+    runtimeVersion: {
+      policy: 'appVersion',
+    },
+    
+    // EAS Update: separate channels
+    // eas.json
+    // {
+    //   "build": {
+    //     "production": {
+    //       "channel": "production"
+    //     },
+    //     "staging": {
+    //       "channel": "staging"
+    //     }
+    //   }
+    // }
+    
+    // Deploy to prod only after staging validation
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EXPO DEEP LINKS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+HIGH PATTERN 4 — Expo Router without validation
+  DETECT:
+    // app/(tabs)/order/[id].tsx
+    // ID comes directly from URL without validation
+    
+    export default function OrderScreen() {
+      const { id } = useLocalSearchParams()
+      // id used directly without validation
+      const order = await fetchOrder(id) // IDOR possible!
+    }
+  
+  FIX:
+    // app/(tabs)/order/[id].tsx
+    import { useLocalSearchParams, useRouter } from 'expo-router'
+    
+    export default function OrderScreen() {
+      const { id } = useLocalSearchParams<{ id: string }>()
+      const router = useRouter()
+      
+      // 1. Validate format
+      const orderId = parseInt(id ?? '', 10)
+      if (isNaN(orderId) || orderId <= 0) {
+        router.replace('/not-found')
+        return null
+      }
+      
+      // 2. Ownership check is done server-side
+      // The server verifies the order belongs
+      // to the authenticated user
+      const { data, error } = useQuery({
+        queryKey: ['order', orderId],
+        queryFn: () => orderApi.getById(orderId),
+        // If 403 → server refused → error handled
+      })
+      
+      // ...
+    }
+
+═══════════════════════════════════════════════════════════════
+              COMPLETE EXPO CHECKLIST
+═══════════════════════════════════════════════════════════════
+
+STORAGE
+  □ expo-secure-store for all tokens and secrets ?
+  □ AsyncStorage only for non-sensitive data ?
+  □ No secrets in expo.extra (app.config.js) ?
+
+OTA UPDATES
+  □ Code signing configured for OTA updates ?
+  □ Separate channels: dev / staging / production ?
+  □ runtime version policy configured ?
+  □ Expo Go forbidden in production ?
+
+DEEP LINKS / EXPO ROUTER
+  □ URL parameters validated in each screen ?
+  □ Auth checked before data access ?
+  □ Universal Links configured (not URL scheme only) ?
+
+ENVIRONMENT VARIABLES
+  □ EXPO_PUBLIC_ only for non-secret values ?
+  □ Secrets managed server-side only ?
+  □ .env in .gitignore ?
+
+BUILD EAS
+  □ Secrets configured in EAS Secrets (not in code) ?
+  □ Production build tested before release ?
+  □ android.allowBackup=false in app.config.js ?