---
title: "Arena, IT Security: hard-coded backdoor in the application"
url: "https://openforis.support/questions/3924/arena-it-security-hard-coded-backdoor-in-the-application"
tags: ["arena-mobile"]
status: "answered"
score: 1
answer_count: 2
asked: "2024-03-20T14:29:22"
last_activity: "2024-03-20T15:38:42"
source: "Open Foris Support - Q&A Forum"
license: "Copyright Open Foris, 2026. Some rights reserved under creative commons license."
---

# Arena, IT Security: hard-coded backdoor in the application

Asked by mklein on 2024-03-20

Dear Support Team,

We are planning to use Open Foris Arena Mobile on Android in our environment. As we work in an administrative network, we are obliged to have the app tested and approved by the responsible CISO. 

Now the test report has come back with the feedback that the app is not approved. We can safely ignore many of the comments. However, when reviewing the audit report in the OWASP summary (pages 5 and 6), we noticed points M6 and M9. These state that there is a hard-coded backdoor in the application that allows a user to gain full access to the smartphone. Understandably, this is not allowed for IT security reasons.

Are you aware of this backdoor? What can we do to close this vulnerability?

I would love to hear from you. You can download the report here: https://ldi-safe.rlp.de/index.php/s/ocJRCn6kNBXfXfd.

Best regards, Markus Klein


## Answer (score 0, by Stefano (OF) on 2024-03-20)

Link: https://openforis.support/questions/3924/arena-it-security-hard-coded-backdoor-in-the-application/3925

Dear Markus,  
We will contact you to your private email address to better understand this issue and to get access to the report (the link doesn't work).  
Many thanks,  
Open Foris Team


## Answer (score 0, by mklein on 2024-03-20)

Link: https://openforis.support/questions/3924/arena-it-security-hard-coded-backdoor-in-the-application/3927

Sorry, here is the correct link... https://ldi-safe.rlp.de/index.php/s/ocJRCn6kNBXfXfd