Overview

This test case checks if the native libraries of the app are compiled without common binary protection mechanisms (MASTG-KNOW-0006) such as stack smashing protection, a mitigation technique against buffer overflow attacks.

Steps

  1. Use MASTG-TECH-0157 to extract the native libraries from the app package.
  2. Use MASTG-TECH-0115 on each native library to obtain the compiler-provided security features.

Observation

The output should show all the security features enabled for each native library, including stack canaries.

Evaluation

The test case fails if stack canaries are disabled.

Developers need to ensure that the flags -fstack-protector-strong, or -fstack-protector-all are set in the compiler flags for all native libraries. This is especially important for custom C/C++ libraries that are not part of the NDK.

When evaluating this please note that there are potential expected false positives for which the test case should be considered as passed. To be certain for these cases, they require manual review of the original source code and the compilation flags used.

The following examples cover some of the false positive cases that might be encountered:

Use of Memory Safe Languages

The Flutter framework does not use stack canaries because of the way Dart mitigates buffer overflows.

Compiler Optimizations

Sometimes, due to the size of the library and the optimizations applied by the compiler, it might be possible that the library was originally compiled with stack canaries but they were optimized out. For example, this is the case for some react native apps. They are built with -fstack-protector-strong but when attempting to search for stack_chk_fail inside the .so files, it is not found.

The React Native developers in this case declare that they won't be adding -fstack-protector-all as, in their case, they consider that doing so will add a performance hit for no effective security gain.