The App uses ECB mode in Cryptographic encryption algorithm.
ID |
objectivec.cryptography.ios_aes_ecb |
Severity |
critical |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
Objective-C |
Description
The App uses ECB mode in Cryptographic encryption algorithm. ECB mode is known to be weak as it results in the same ciphertext for identical blocks of plaintext.
Rationale
The App uses ECB mode in Cryptographic encryption algorithm. ECB mode is known to be weak as it results in the same ciphertext for identical blocks of plaintext.
The following code illustrates a vulnerable pattern detected by this rule:
// ============================================
// POSITIVE CASES (should trigger findings)
// ============================================
NSData* badAESECBEncrypt(NSData *data, NSData *key) {
size_t bufferSize = data.length + kCCBlockSizeAES128;
void *buffer = malloc(bufferSize);
size_t numBytesEncrypted = 0;
// VULNERABLE: The App uses ECB mode in Cryptographic encryption algorithm.
CCCryptorStatus status = CCCrypt(kCCEncrypt,
kCCAlgorithmAES,
kCCOptionECBMode,
key.bytes,
key.length,
NULL,
data.bytes,
data.length,
buffer,
bufferSize,
&numBytesEncrypted);
if (status == kCCSuccess) {
return [NSData dataWithBytesNoCopy:buffer length:numBytesEncrypted];
}
free(buffer);
return nil;
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.