Your app contains unsafe cryptographic encryption patterns (in dynamically loaded code)

Question

This recently popped out pre-launch report, once I published minor update to app.

I've seen also couple of similar recently in other projects, with class names obfuscated in exactly same name (bjqm.* , bpce.*).

I wonder whats causing it (which dep)? Note that it's dynamically loaded code. These classes are nowhere to be seen in "obfuscation mapping.txt", I didn't catch classes either in heap dump. Also I've tried to submit app without obfuscation into internal builds, but these classes are still scrambled / obfuscated in pre-launch report.

It seems Google has updated static analyzers recently as minor change I did in codebase doesn't cause it.

I am getting the EXACT same issue, with the EXACT same names bjqm.c and bpce.b... its very strange. Will also do a re-upload and see if it works — Zee
– Zee, Commented Apr 26, 2023 at 11:58
I just got this warning even though I didn't have this warning a week ago when I submitted another update. Very similar code, just minor changes. I did update some ad network libraries. Anyone know how I can track which libraries might be causing this? — casolorz
– casolorz, Commented May 8, 2023 at 13:56
Maybe it is com.google.android.gms:play-services-basement dep (it's a subdep of play-services-location, firebase-message & others). It seems to have following fixed in 18.0.2; "The latest updates to the play-services-basement library improve security on signature verification and address the mutable PendingIntent vulnerability.". @Zee if you could try bumping play-services-location to latest (21.0.1). Use “./gradlew app:dependencies” to test you have play-services-basement >= 18.0.2 in project. I upgraded play-services-location from 17.0.0->21.0.1 and basement is now 18.1.0 from 17.0.0 — Erkki Nokso-Koivisto
– Erkki Nokso-Koivisto, Commented May 11, 2023 at 8:24
@ErkkiNokso-Koivisto if I undo the upgrade, it seems to be depending on basement 18.1.0... so now im not sure. But the error is still now showing in Play :( — Zee
– Zee, Commented May 11, 2023 at 12:32
I'm on 18.2.0 for base and 18.1.0 for basement and got the pre launch report error last night. I found out you can upload the bundle and not submit it for review and it still generates the pre launch report so I'm just testing that way. — casolorz
– casolorz, Commented May 11, 2023 at 14:41

macrotech · Accepted Answer · 2023-05-05 10:18:09Z

2

I am having EXACTLY the same issue with completely identical messages, but they seem to appear randomly. I successfully sumbitted the latest version of my app yesterday and it was published to the Store. When I look at that release in the Dashboard this morning, the two errors have been added. The same happened for a previous release. What is going on?

By the way, as a newbie, I wanted to add a comment to the original question, but I'm not allowed to. Apologies if adding an answer isn't correct protocol.

edited May 5, 2023 at 10:18

answered May 5, 2023 at 10:14

macrotech

213 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

casolorz Over a year ago

Is this leading to an apk rejection? I only have the pre-launch report so far, nothing else. Edit: to answer my own question, nope, it didn't lead to an apk rejection.

casolorz Over a year ago

So yesterday I uploaded two bundles but only released one. I just realized the one I never released is the one that triggered the alert, so I don't actually know if that would lead to an apk rejection.

Erkki Nokso-Koivisto · Accepted Answer · 2023-04-25 21:03:20Z

1

I resubmitted another build of app with zero changes, and "Unsafe encryption" and "Implicit Pending Intent" errors are gone :)

edited Apr 25, 2023 at 21:03

answered Apr 25, 2023 at 20:21

Erkki Nokso-Koivisto

1,29018 silver badges23 bronze badges

Comments

manelizzard · Accepted Answer · 2023-05-16 08:49:35Z

1

Not sure if it was luck or our action but, using Unity and Easy Save 3 plugin, we suffered this issue. After updating Easy Save 3 plugin to its latest version, Google Play stopped complaining.

Just in case this information is helpful for somebody

answered May 16, 2023 at 8:49

manelizzard

1,0689 silver badges19 bronze badges

Comments

StarCue · Accepted Answer · 2023-05-24 15:37:03Z

1

I had the same problem as you bjqm.c, bjqm.d, bpce.b

after that I changed SharedPreference to EncrytedSharedPreference and submitted an update. And all warnings are gone.

EncryptedSharedPreference Google doc

if you use SharedPreference, you can try this. good luck

answered May 24, 2023 at 15:37

StarCue

712 silver badges12 bronze badges

2 Comments

casolorz Over a year ago

Were you doing some encryption stuff with SharedPreference or do you think the library was doing something?

StarCue Over a year ago

Previously I used SharedPreference and no encryption. After that I encrypted the SharedPreference using EncryptedSharedPreference and all warnings went away. I just followed the recommendations in the google docs for warnings.

Collectives™ on Stack Overflow

Your app contains unsafe cryptographic encryption patterns (in dynamically loaded code)

4 Answers 4

2 Comments

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related