False negatives: hardcoded secrets

[vasconcedu]

I'm performing an academic experiment in which I'm seeding vulnerabilities in mobile app codebases and then trying to find them. I'm using mobsfscan for this purpose.

I believe it is failing to find hardcoded secrets in some cases. There is no significant entropic difference between the hardcoded secrets which it is able to find successfully and hardcoded secrets which it fails to find.

For instance, it successfully reported the following excerpt as a hardcoded secret:

private static final String KEY = "fa753769876edbdb876704bc0111b2a681d321afe631ffd5aacd20e2754f2a39181613c8d2f21e336d5e270bff900be643a19c1ddfb00b9008e580cacf9b1e36bcbc5ec7db1949f4f46a3f348cae5a4eedace9de32687c885d4d8e1facd0db26fea33b899bd761fb2ffd44ceb634c42541ee79ae6eb3b6f34afff0b5382524250258c32f6f22946ad44ea80e06db20317e565c445f35ef3cd6bc2d688e4832b0cfda99b4c88ef1fefbcd7e5a0e9641294142b8a6fbfc2423b99feeb810f720c63aa1f6ddc4d25455177384a9d5660772be91f231f24022de7f22e60961db971d42f268089f4be8c40c214e2d6e95d35827386aa9f777e371a4f1e817880ea693";

But it failed to report the following excerpt as a hardcoded secret:

private val KEY = "b4071281f217866037bb02f1d125ab5c2533eca404e95b9f19f097227bcaad4fffb8aeda6042f4225623a1a23e50ed669ca508b570ba0f53306d6eb7b04941c9f3047e564ec9c0afef3ecadf5493edb6c0b4432ecde5f1f644e7dafa727774d3a43f472845d855113f0bb7ffe79bf80efa6bdb0f53607f691bc1ad65d3503c7b8847e6a50f884abf017047ad4144c6f1561c4b5653b7b8251db0f9757ab55562dd432dbd75479d5282cf08658f4fe52b175d7fc476b59e625abb057d9413d62d080a5050a47795536f594407aaa89f1df88abba879d091e81abe37ef74bb01912df82e4b10ea3e25bba80f837d0153917442c611f411093fbacd30aab4158719"

I have found numerous instances of this failure pattern, and I can provide further detail and samples if necessary. What's more, as much as I cannot generalize this observation based solely on the results I have obtained so far, in my experimental setting, I have noticed that false negatives like this seem to occur specifically for apps coded in Kotlin.