New Risk - Insecure Random Usage [insecure-random]

[cpholguera]

Description

Create a new risk for "Insecure Random Usage (MASVS-CRYPTO-1)" using the following information:

Using a non-cryptographically secure PRNG in a security context, such as authentication, poses significant risks. An attacker could potentially guess the generated numbers and gain access to privileged data or functionality. Predicting or regenerating random numbers can lead to encryption breaches, compromise sensitive user information, or enable user impersonation.

Create "risks/MASVS-CRYPTO/1-***-****/insecure-random/risk.md" including the following content:

---
title: Insecure Random Usage
alias: insecure-random
platform: [android, ios]
profiles: [L1, L2]
mappings:
  masvs-v1: [MSTG-CRYPTO-6]
  masvs-v2: [MASVS-CRYPTO-1]
  mastg-v1: [MASTG-TEST-0063, MASTG-TEST-0016]

---

## Overview

## Impact

## Modes of Introduction

## Mitigations

To complete the sections follow the guidelines from Writing MASTG Risks & Tests

Use at least the following references:

• https://developer.android.com/reference/java/security/SecureRandom
• https://developer.android.com/topic/security/risks/weak-prng
• https://developer.android.com/privacy-and-security/cryptography#deprecated-functionality
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf

MASTG v1 Refactoring:

If the risk has a MASVS v1 ID, you can use it to search for related tests in the MASTG and use them as input to define your risks and associated tests.

• MASTG-TEST-0063 - Testing Random Number Generation (ios)
• MASTG-TEST-0016 - Testing Random Number Generation (android)

Acceptance Criteria

• The risk has been created in the correct directory (risks/MASVS-CRYPTO/1-***-****/insecure-random/risk.md)
• The risk content follows the guidelines
• At least one GitHub Issue has been created for the corresponding tests (derived from "Modes of Introduction")
• The risk indicates the related MASTG v1 tests in its metadata.

[sk3l10x1ng]

@cpholguera please assign to me , i will work on it .

[cpholguera]

Hi @sk3l10x1ng I just noticed that we actually have this one already (we created it as part of #2518). It'd be nice if you could review it and propose changes and corrections if you have any.

I'll close this ticket but if you want I can assign you this one:

#2557

[sk3l10x1ng]

Hi @sk3l10x1ng I just noticed that we actually have this one already (we created it as part of #2518). It'd be nice if you could review it and propose changes and corrections if you have any.

I'll close this ticket but if you want I can assign you this one:

#2557

could please assign #2573, i will work on this , thank you