APK_DEBUG_SYMBOL_PRESENT

MOBILE_CLIENT/ANDROID/_LOW/APK_DEBUG_SYMBOL_PRESENT/description.md

@@ -0,0 +1,9 @@
+The application is shipped debug symbols and debug information such as debugging information, line numbers, and descriptive function or method names, which make it easier to reverse engineer.
+
+It is noteworthy that most crash reporting tools support uploading symbols to perform stack trace symbolization and don't require symbols to be present in the application.
+
+To verify that the native libraries are not shipped with debug symbols, use the following command:
+
+```bash
+readelf --debug-dump=info <library>
+```

MOBILE_CLIENT/ANDROID/_LOW/APK_DEBUG_SYMBOL_PRESENT/meta.json

@@ -0,0 +1,21 @@
+{
+  "risk_rating": "low",
+  "short_description": "Debug Symbols were found in the application, which can help with reverse engineering the application or leaking internal information.",
+  "references": {
+  },
+  "title": "Debug Symbols Present in the Application",
+  "privacy_issue": false,
+  "security_issue": true,
+  "categories": {
+    "OWASP_MASVS_L1": [
+      "MSTG_CODE_3"
+    ],
+    "OWASP_MASVS_L2": [
+      "MSTG_CODE_3"
+    ],
+    "PCI_STANDARDS":[
+      "REQ_2_2",
+      "REQ_6_2"
+    ]
+  }
+}

MOBILE_CLIENT/ANDROID/_LOW/APK_DEBUG_SYMBOL_PRESENT/recommendation.md

@@ -0,0 +1,10 @@
+Remove all symbols and debug data from the application. 
+
+To do so, here are some recommendations:
+
+* Configure the build type to exclude debug information.
+* Use [ProGuard](https://www.guardsquare.com/en/products/proguard) to strip native debugging symbols.
+* Use the `strip` command to remove symbols from native libraries:
+```bash
+strip -s <library>
+```