Introduction
This technical summary report describes the results of a large-scale assessment of various components within the TunnelBear VPN complex. This project, which was carried out by Cure53 in November 2019, entailed a broadly-scoped penetration test, a security review, as well as auditing of sources pertinent to the selected items from the TunnelBear VPN scope. Both the project itself and the ensuing report on the security assessment's format, methods and findings were requested by the maintainers of the TunnelBear compound. In terms of the objectives, the main goal was to gain an up-to-date image of the scope with an in-depth, extensive security review. In other words, the TunnelBear team has a continuing and well-founded interest in knowing how well their security promises actually hold against determined attackers. Cure53 assists them in these efforts by assuming the roles of attackers and attempting to find blind spots that might have slipped past the generally exceptional levels of security handling at the TunnelBear complex. It should be noted that the Cure53-TunnelBear security-driven cooperation was established in 2016. The current report, stemming from the work conducted in 2019, is a third summary of this type provided by Cure53, with the initial one issued in the summer of 2017 and the second shared with the TunnelBear team in 2018. As a result of previous engagements, it can be said that the Cure53 team generally has a certain degree of familiarity with the TunnelBear compound. However, with ongoing projects like audits and tests against various items in the TunnelBear scope performed since the last assessment, Cure53 is happy to issue an updated verdict on the current security posture of the TunnelBear complex.
Test Summary & Methodology
Given the breadth and depth of this assignment, a budget dedicated to its completion stood at thirty-seven person-days in total. The Cure53 team inspected and analyzed the security posture of the TunnelBear scope over the course of Calendar Weeks 45 and 46 2019, signifying late autumn. With the multi-layered and multi-dimensional nature of the scope, ten members of the Cure53 team were drafted to take part in this project. Each tester/auditor had been chosen on the basis of the optimum, advanced and complimentary skills possessed by the members who all had a proven capacity of addressing the assessment's goals as efficiently and as comprehensively as possible. Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Capitalizing on best practices implemented in previous testing installments Cure53 was granted a level of access deemed as necessary for reaching an expected level of coverage on all included parts within the software and infrastructure compound. The TunnelBear team made all relevant configuration data, tests-servers and test-user credentials, as well as relevant source code, available to Cure53. Further, the testing team could consult material deposited into GitHub repositories utilized by TunnelBear. For this autumn 2019 assessment, six components of the TunnelBear complex were specially chosen as the main items to be examined. Based on this selection, Cure53 delineated six Work Packages (WPs) with specific test-targets. The WP1 centered on the TunnelBear client applications, spanning iOS, Android and Windows branches. All apps were subject to penetration testing and received dedicated code audits. Next, in WP2, Cure53 investigated the TunnelBear browser extensions, deploying same methods as above. Slightly altered methodology of a configuration review paired with penetration testing was adopted in the VPN infrastructure examination in WP3. While WP4 zoomed in on the TunnelBear FilterPods, WP5 shifted to the backend of both TunnelBear and PolarBear. Rounding the scope was Work Package 6, which concerned the TunnelBear frontend and public site. The project started on time and progressed efficiently, with no noteworthy technical issues hindering the completion of the various steps within the investigations. As the investigations went on, Cure53 filed the discoveries into a JIRA instance made available for this assessment. In addition, communications between the teams were facilitated by Slack. To clarify, TunnelBear opened a dedicated channel on their workspace and invited the participating Cure53 members to join it. On Slack, Cure53 could ask questions, give feedback about the emerging findings, as well as discuss the process of fix verification executed by the in-house team at TunnelBear for the live-reported issues.
Audit Results
The findings underline the importance of a temporal perspective being adopted when discussing and assessing the security premise characterized by extreme complexity. Over several years since 2016, Cure53 has gained substantial knowledge about the complex and can issue an evidence-based verdict about the progress being made at the TunnelBear entities as regards security. The improvement observed within TunnelBear can certainly be attributed to the dedication and skill-level of the in-house team, which manages to have a good grasp over the security landscape, in spite of the noted size and intricacies of the compound they are protecting. Even though there can be no doubt about the TunnelBear project becoming more and more secure with subsequent assessments, the testers from the Cure53 team still Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de identified twelve security-relevant items across the executed Work Packages. Compared to the last round of testing, the total number of issues affecting the complex has been nearly cut in half, again ascertaining to a considerable amelioration. Examining the problems at the meta-level reveals that six items should be seen as actual vulnerabilities, while those in the remaining batch can be classified as general weaknesses with arguably lower exploitation potential. All identified issues are presented in the table below. Ouite clearly, attention should be drawn primarily to the notable issues with “Critical” and “High” severities.
Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de
Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de
Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de It is important to note that Cure53 assisted the TunnelBear team with developing some of the fixes, especially when more fine-tuned recommendations were needed because the choice of a solution was not immediately apparent. Nevertheless, it must be underscored that the Cure53 team did not perform a full and complete retest but rather engaged in a thorough and comprehensive fix verification, confirming that mitigation strategies deployed by the TunnelBear are sound and aligned with various modern and up-to-date recommendations. The main focus has been placed on devising processes that can help TunnelBear make sure that security resources are correctly allocated to regular audits and targeted checks, with the aim of preventing recurrence and regressions.
Conclusions
Finalizing the last report, which was issued in 2018, Cure53 has already stated that the TunnelBear today is a completely different complex than the one initially encountered by the testing team back in 2016. From a security perspective, the difference is quite extreme as just a few years proved to be enough to eradicate nearly all mistakes and security flaws The TunnelBear complex has been transformed from being just 'average' to becoming a clear frontrunner among its VPN competitors when it comes to security. On this note, looking at the project in its entirety through a temporal lens cannot be downplayed, especially as the periodic and long-term engagement over the years made the Cure53 team equipped with substantial knowledge-base when it comes to the TunnelBear security. Not only the mutual trust, but also the methods, have been steadily developed and improved, with current approaches being extremely well battle-tested. As a result, the Cure53’s conclusions feature aspects of comparability, consistency and logic of examination that can only be achieved over time. To reiterate, the results of this autumn 2019 Cure53 assessment of the TunnelBear VPN complex point to right direction of development being properly maintained. The benchmarks are better and better, while ambitious security milestones are being set, despite the TunnelBear's increasing scale and complexity. After spending thirty-seven days on the scope in November 2019, ten members of the Cure53 team can conclude that the security posture of the tested TunnelBear components is sound and generally solid. On the one hand, the presence of twelve security-relevant findings, inclusive of several rather severe flaws - marked as Critical and High, cannot be disregarded. Further, Cure53 managed to spot issues across all six Work Packages, meaning that every component of TunnelBear remained exposed to some risks. On the other hand, the findings must be read in the context of a pronounced vastness of this modern and ever- growing scope. Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Taking all evidence and observations into consideration, the testing team is happy to report that both the total number and the spectrum of severities displayed by the spotted findings have diminished. Even though Cure53 covered a similar scope in 2019 as it did in the past assignment in 2018, the overall results indicate that TunnelBear benefits from more advanced security approaches and safeguards its users to a much greater extent. In that sense, Cure53 wishes to underline a definite and measurable improvement in the TunnelBear's security posture. The fact that this round of penetration testing required a considerable number of deep-dives to uncover potential issues is also significant, as it effectively means that exposure to classic, standard and typical security problems is a thing of the past for the TunnelBear complex. In this context, Cure53 wishes to draw attention to both dedication and excellent skills displayed by the TunnelBear team over the course of this autumn 2019 assessment. One example of note was the professional and prompt communication during the test, which effectively led to the patch management being deployed in record time. As a result, Cure53 was able to review the first bug fixes when the tests were still ongoing To summarize, the TunnelBear complex should be seen as always trying to have an edge over its competitors when it comes to security. With this third testing round completed in November 2019, Cure53 has gathered enough evidence to attest to the changing and improving posture of the numerous TunnelBear components. Despite finding a number of vulnerabilities and miscellaneous weaknesses that can be potentially turned into vulnerabilities, the Cure53 testing team is positively surprised about the directionality and pace of secure implementations becoming a standard at TunnelBear. All in all, TunnelBear is definitely on the right path and stands out as a mature application which clearly cares about their project's security posture and privacy of their users.