Potentially Use non-random initialization vector (IV)

Description

Use of a non-random initialization vector makes the application vulnerable to dictionary attacks.

The following example demonstrates improper settings of hardcoded static IV:

public class InsecureExample {
    @Override
    public void run() throws Exception{
        byte[] IV = "0123456789abcdef".getBytes();
        String clearText = "Jan van Eyck was here 1434";
        String key = "ThisIs128bitSize";
        SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes(), "AES");
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, skeySpec, new IvParameterSpec(IV));
        byte[] encryptedMessage = cipher.doFinal(clearText.getBytes());
        Log.i(TAG, String.format("Message: %s", Base64.encodeToString(encryptedMessage, Base64.DEFAULT)));
    }
}

Recommendation

Properly initialize the IV with a secure random value

Technical details
[TAINT] Const '16' ==>>> Sink '['Ljavax/crypto/spec/IvParameterSpec;', '<init>', '([B I I)V', '2', 'CRYPTO_SINK']' [[('Lcom/exoplayer2/upstream/EncryptedFileDataSource2$a;', 'a', '(J)J'), ('Ljavax/crypto/spec/IvParameterSpec;', '<init>', '([B I I)V')]]

The application uses a hardcoded initialization vector (IV) to encrypt the data

Method com.exoplayer2.upstream.EncryptedFileDataSource2$a.a():


    public long a(long p10)
    {
        long v0_1 = this.a.skip(p10);
        try {
            byte[] v10_4;
            int v4_1 = ((int) (p10 % 16));
            byte[] v10_3 = new java.math.BigInteger(1, this.d.getIV()).add(java.math.BigInteger.valueOf(((p10 - ((long) v4_1)) / 16))).toByteArray();
        } catch (Exception) {
            return 0;
        }
        if (v10_3.length >= 16) {
            v10_4 = new javax.crypto.spec.IvParameterSpec(v10_3, (v10_3.length - 16), 16);
        } else {
            javax.crypto.Cipher v11_6 = new byte[16];
            System.arraycopy(v10_3, 0, v11_6, (16 - v10_3.length), v10_3.length);
            v10_4 = new javax.crypto.spec.IvParameterSpec(v11_6);
        }
        this.b.init(1, this.c, v10_4);
        byte[] v10_7 = new byte[v4_1];
        this.b.update(v10_7, 0, v4_1, v10_7);
        java.util.Arrays.fill(v10_7, 0);
        return v0_1;
    }

Method javax.crypto.spec.IvParameterSpec.<init>() not found.