Description

This detector identifies the use of insecure AES cipher modes in Kotlin code, particularly ECB (Electronic Codebook) mode which is cryptographically weak. ECB mode exposes patterns in encrypted data because identical plaintext blocks produce identical ciphertext blocks, making it vulnerable to various attacks including pattern analysis and chosen-plaintext attacks.

Detection Strategy

• Scans Kotlin code for specific cryptographic method calls that configure AES ciphers (such as Cipher.getInstance() calls)

• Examines the first parameter (transformation string) passed to these cipher configuration methods

• Reports a vulnerability when the transformation string specifies an insecure AES cipher mode, typically ECB mode or other weak cipher configurations

• Triggers when unsafe cipher mode definitions are detected in the method parameter, indicating the use of cryptographically insecure AES encryption

Vulnerable code example

import javax.crypto.Cipher

class VulnerableCipher {
    fun encrypt(): Cipher {
        // Vulnerable: using NoPadding which can lead to padding oracle attacks
        val cipher = Cipher.getInstance("AES/CBC/NoPadding")
        return cipher
    }...

✅ Secure code example

import javax.crypto.Cipher

class VulnerableCipher {
    fun encrypt(): Cipher {
        // Safe: using GCM mode which provides authenticated encryption
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        return cipher
    }...