Examkin

Soru

Zorluk: KolayCryptographic and Security Control Weaknesses

A security team conducts a static code analysis on a newly developed mobile application. The review reveals that the application uses a hardcoded secret key embedded directly inside the compiled source code to encrypt local user session tokens. Which of the following best describes the primary cryptographic security weakness in this application design?

  1. Hardcoded key usage, which allows attackers to extract the secret key through reverse engineering of the application binary.Cevap
  2. B
    Incorrect control classification, where a preventive access control is misclassified as a detective security mechanism.
  3. C
    Improper PKI certificate lifecycle management caused by missing certificate authority signing requests.
  4. D
    Over-reliance on network perimeter boundaries to isolate application data at rest.

Cevap

Hardcoded secret keys embedded inside compiled application binaries allow attackers to extract the key through reverse engineering, compromising the security of all data encrypted with that key.
Embedding secret cryptographic keys directly inside source code or compiled application binaries creates a severe vulnerability known as hardcoded key usage. Because mobile application binaries reside on end-user devices, attackers can decompile or disassemble the software using standard reverse engineering tools, extract the secret key, and decrypt all protected session tokens.

Adım Adım Çözüm

1
Analyze the scenario details.
The application code contains an embedded, fixed secret key used for local encryption.
Static code analysis identified a hardcoded secret key directly within the compiled mobile application binary.
2
Evaluate the risk of embedding static cryptographic keys in client applications.
Attackers can decompile the mobile binary and extract the hardcoded key.
Client binaries are untrusted environments; any embedded secret key can be recovered using basic reverse engineering tools.
3
Identify the primary cryptographic control weakness.
The weakness is hardcoded key storage leading to key exposure.
Proper key management requires dynamically generated keys or secure storage mechanisms (such as hardware keystores or key vaults) rather than hardcoded code strings.

Anahtar Kavram

Hardcoded Cryptographic Keys
Bu soruyu puanla

Konular

Cryptographic and Security Control Weaknesses

Bu konudan daha fazla soru