support@saseclabs.tech
Please give a reasonable chance to fix an issue before disclosing it publicly,
and test only against your own device. There is no bounty, but every report
is read and answered.
What is in scope
SenseScan decodes untrusted images with a decoder written in C++. The
decoder runs before every guard the app has, and memory corruption there is
possible. A picture has already made it read
past the end of a buffer: an ordinary GIF, through a fault in this app's own
code, since fixed. Crashes, out-of-bounds access
and anything reachable by handing the app a crafted image or code are wanted.
So is anything that makes the screen say something different from what
a code actually contains. That is the app's whole security property.
A display that can be made to lie is a real finding even when nothing crashes
— a payee that reads as one account and hands another to a payment app, an
address that draws as a name it is not, a character that disappears.
What is already documented, and is not a vulnerability
SenseScan does not judge whether a link is safe. It shows
what a code contains. That is the design, stated in the app and on its
page, not an oversight.
It cannot check reputation. With no internet permission it
can never know a domain is new or known for fraud.
It does not detect look-alike letters. A Cyrillic
character inside a Latin domain is shown percent-encoded so it cannot draw
as the real name, but no comparison against brands is made.
It does not protect a rooted or malware-infected device,
or one unlocked in an attacker's hands.
It keeps almost nothing between sessions — no history
and no database. The one thing kept is what the user saves under My shop:
each saved QR, exactly as it reads, excluded from backups. Scanning a saved or shared picture makes a temporary copy in the
app's own private storage, which is deleted as soon as the scan
finishes. Text sent to it is read in memory and never written to
storage. An attacker who fully compromised the app would gain a camera,
and the accounts saved there — which those QR codes already show to
anyone who scans them.
What helps a report land
The exact payload or image, if you can share it.
What the screen showed, and what it should have shown.
The device and Android version.
Whether it reproduces from the camera, from a saved picture, or both.