This version requires you to install Corellium 6.4.0 first.
LDAP Authentication
Corellium is happy to annoumce that we now support LDAP as an addition to our SSO offerings.
For more information about how to configure LDAP please see our documentation.
MATRIX Improvements
Matrix is not longer in Beta. Interested in Adding MATRIX to you account please contact your Corellium representative.
MATRIX additions and improvements just keep coming. Here are some things you can look forward to in this release.
The Introduction of Atrifacts
A new type of content in MATRIX reports! artifacts are informational items pulled from the target app, such as application databases, keychain dumps, and Plist files. These artifacts display in the MATRIX report as a file path or code block, so users can investigate them further. Users can also download them in HTML and JSON file formats.
This release will include six artifacts for iOS devices only.
- Application Code Sizing
- Keychain Dump
- Application Databases
- Application Certificates
- Plist Files
- Background Modes
Artifacts for Android devices are coming soon!
If a user wants to investigate an artifact further, they can copy/paste the resulting info into a new keyword file and run another MATRIX test!
Artifact Summary: When a user views the interactive MATRIX report, specifically the summary of Results at the top, they will see an "artifact" counter.
Auto-Select Uploaded App
Previously, after a user uploaded a target app via MATRIX, they had to manually search for and select it before starting their test. That meant extra steps and potential confusion. Now, whichever app they upload will auto-select.
Corellium Version vs. App Version
Previously, we only showed the Corellium version on JSON and HTML report. This meant UI users needed to dig around to learn what version of MATRIX they had run the target app against. Now, we show Corellium Version in the UI on both the History page and Interactive Report. We also clarify App Version and Corellium Version.
Error Messaging Improvements
We now display error messages for checks in the UI. User no longer have to go to the HTML or JSON downloads to view these errors.
CLI / API
we continued to roll out improvements to our CLI and API, creating a more robust and coherent experience for end users.
New Android Checks
Category | Name |
---|
Auth | Insecure Biometric Implementation |
Crypto | Insecure Random Number Generation |
Platform | Application is Vulnerable to Overlay Attacks |
Network | Insecure Security Provider |
Network | Insecure TLS Configuration |
Network | Cookie Missing httpOnly Flag |
Network | Cookie Missing secure Flag |
New iOS Checks
Category | Name |
---|
Network | HTTPS Traffic URL Contains Device's GPS Latitude |
Network | HTTPS Traffic URL Contains Device's GPS Longitude |
Network | HTTPS Traffic URL Contains Device IMEI |
Network | HTTPS Traffic URL Contains Sensitive Data |
Network | HTTPS Traffic URL Contains WiFi MAC Address |
Network | HTTP Cleartext Transmission of Advertiser ID |
Network | Cookie Missing httpOnly Flag |
Network | Cookie Missing secure Flag |
Storage | Local Data Exposure: Advertiser ID Stored Insecurely |
Storage | Local Data Exposure: Advertiser ID Logged Insecurely |
Bugs Fixes
We ended our MATRIX improvements with an amazing "bug bash." We dedicated significant effort to make MATRIX even more reliable from the individual checks to our overall application itself.
- Fixed completed MATRIX tests that were stuck in
awaiting testing
- Fixed inconsistencies in MATRIX results across various Android firmware versions.