Penetration Test Report (IncludeSecurity): Streisand security config review

Security Assessment of Streisand
for Open Technology Fund
Page 1 of 39
TABLE OF CONTENTS
EXECUTIVE SUMMARY .......................................................................................................................................... 3
Scope and Methodology ................................................................................................................................... 3
Assessment Objectives ..................................................................................................................................... 3
Findings Overview ............................................................................................................................................. 3
Next Steps ......................................................................................................................................................... 3
ASSESSMENT RESULTS .......................................................................................................................................... 4
Introduction .......................................................................................................................................................... 5
Supported Services ........................................................................................................................................... 5
General Security Recommendations ................................................................................................................ 6
HIGH-RISK FINDINGS ............................................................................................................................................. 9
H1: [OpenVPN,OpenConnect] IPv6 Traffic Disclosed ....................................................................................... 9
H2: [Monit] Out-of-Date Components in Use ................................................................................................. 10
H3: [IPSec] Deprecated Cipher Suites and Authentication Methods Supported............................................ 12
H4: [Gateway] Installation of Self Signed Trusted Root Certification Authority Certificate ........................... 14
MEDIUM-RISK FINDINGS ..................................................................................................................................... 17
M1: [Gateway] Deprecated TLS Ciphers Supported ....................................................................................... 17
M2: [Monit] Sensitive Operations Vulnerable to Cross-Site Request Forgery ............................................... 20
M3: [Shadowsocks] Known Protocol Flaws .................................................................................................... 21
LOW-RISK FINDINGS............................................................................................................................................ 23
L1: [OpenConnect] Deprecated TLS and DTLS Ciphers Supported ................................................................. 23
L2: [Ansible] Obtaining Deployed SSH Public Keys May Reveal Users' Identities ........................................... 26
L3: [AWS] EC2 Instance Metadata Accessible to VPN and Proxy Users .......................................................... 27
L4: [stunnel] Deprecated TLS Ciphers Supported ........................................................................................... 29
L5: [Monit] Administration Page Accessible Through Proxies ........................................................................ 31
L6: [Gateway] Streisand Gateway Was Fingerprintable ................................................................................. 33
L7: [Gateway,LT2P/IPSEC] Password Generation uses Low Entropy Sources for Randomness ..................... 34
L8: Tor Browser Bundle Uses Default Security Settings.................................................................................. 35
APPENDICES ........................................................................................................................................................ 38
A1: Credential Complexity, Usage, and Storage Considerations .................................................................... 38
Page 2 of 39
EXECUTIVE SUMMARY
Scope and Methodology
IncludeSec performed a security assessment of Streisand for Open Technology Fund. The
assessment team performed a 5 day effort spanning from March 19th – March 23, 2018. The
scope of the assessment was limited to a security configuration review of the Streisand HTTP
Gateway, VPN, Proxy services, ansible playbooks, and Streisand hosts for hardening
recommendations.
Assessment Objectives
The objective of this assessment was to identify and confirm potential security vulnerabilities
within the in-scope targets. The team assigned a qualitative risk ranking to each finding.
IncludeSec also provided remediation steps which Streisand could implement to secure its
applications and systems.
Findings Overview
IncludeSec identified 15 categories of findings. There were 0 deemed a “Critical-Risk,” 4
deemed a “High-Risk,” 3 deemed a “Medium-Risk,” and 8 deemed a “Low-Risk,” which pose
some tangible security risk.
IncludeSec encourages Streisand to redefine the stated risk categorizations internally in a
manner that incorporates internal knowledge regarding business model, customer risk, and
mitigation environmental factors.
Next Steps
IncludeSec advises Streisand to remediate as many findings as possible in a prioritized manner
and make systemic changes to the Software Development Life Cycle (SDLC) to prevent further
vulnerabilities from being introduced into future release cycles. This report can be used by
Streisand as a basis for any SDLC changes. IncludeSec welcomes the opportunity to assist
Streisand in improving their SDLC in future engagements by providing security assessments of
additional products.
Page 3 of 39
ASSESSMENT RESULTS
At the conclusion of the assessment, Include Security categorized findings into four levels of
perceived security risk: critical, high, medium, or low. Any informational findings for which the
assessment team perceived no direct security risk, were also reported in the spirit of full
disclosure. The risk categorizations below are guidelines that IncludeSec believes reflect best
practices in the security industry and may differ from internal perceived risk. It is common and
encouraged that all clients recategorize findings based on their internal business risk
tolerances. All findings are described in detail within the final report provided to Streisand
Effect.
Critical-Risk findings are those that pose an immediate and serious threat to the company’s
infrastructure and customers. This includes loss of system, access, or application control,
compromise of administrative accounts or restriction of system functions, or the exposure of
confidential information. These threats should take priority during remediation efforts.
High-Risk findings are those that could pose serious threats including loss of system, access, or
application control, compromise of administrative accounts or restriction of system functions,
or the exposure of confidential information.
Medium-Risk findings are those that could potentially be used with other techniques to
compromise accounts, data, or performance.
Low-Risk findings pose limited exposure to compromise or loss of data, and are typically
attributed to configuration issues, and outdated patches or policies.
Informational findings pose little to no security exposure to compromise or loss of data which
cover defense-in-depth and best-practice changes which we recommend are made to the
application.
The findings below are listed by a risk rated short name (e.g., C1, H2, M3, L4, I5) and finding
title. Each finding includes: Description (including proof of concept screenshots and lines of
code), Recommended Remediation, and References.
Page 4 of 39