Penetration Test Report (Cure53): pentest report psiphon

Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Pentest-Report Psiphon 06.-07.2017
Cure53, Dr.-Ing. M. Heiderich, Dipl.-Ing. A. Aranguren, M. Wege, BSc. F. Fäßler,
Dipl.-Ing. A. Inführ, MSc. N. Kobeissi, MSc. N. Krein, BSc. C. Kean, BSc. D. Weißer, J. Larsson
Index
Introduction
Scope
Identified Vulnerabilities
PSI-01-001 Browser/Protocol: Server IP Leak via Traffic Fingerprinting (Info)
PSI-01-005 Browser: Trivial Censorship Attack via DNS Blocking (Info)
Miscellaneous Issues
PSI-01-002 Server: SSH Banner makes Fingerprinting trivial (Info)
PSI-01-003 Browser: “Disable - JavaScript” Feature Bypass (Medium)
PSI-01-004 Browser: Popup Blocker Bypass via endlessipc:// Handler (Low)
PSI-01-006 Browser: WebView HTML Leaks reveal User IPs (Medium)
PSI-01-007 Browser: Psiphon User Agent leaks via Image Download (Low)
PSI-01-008 Browser: IP Leaks via Links to external Apps (Low)
PSI-01-009 Server: Psiphon Server list world readable (Info)
Cryptography-Specific Findings
Cryptographic Primitives
Exotic Cryptographic Constructions
OpenSSH Handshake Obfuscation
Shamir Secret Sharing for Revealing New Servers
Cryptographic Protocol State and Flow
Protocol Recommendations
General Notes
Conclusions
Cure53, Berlin · 12/22/17 1/19
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Introduction
“Psiphon is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP
Proxy technology to provide you with uncensored access to Internet content. Your
Psiphon client will automatically learn about new access points to maximize your
chances of bypassing censorship. Psiphon is designed to provide you with open access
to online content. Psiphon does not increase your online privacy, and should not be
considered or used as an online security tool.”
From https://www.psiphon3.com/en/index.html
This report documents the findings of a Cure53 security assessment of Psiphon entities.
The test took place in late June and early July of 2017 and was carried out over the
course of twenty-two days. A team of nine testers from the Cure53 team was involved in
this project, which overall resulted in a positive outcome regarding the security of the
tested Psiphon suite. The tests revealed a surprisingly small number of findings which,
even more unexpectedly, had very low severity rankings.
The assessment set out to examine a rather large number of security realms at Psiphon.
In scope were multiple components of the Psiphon software compound, including the
tunnel-core client and server, the library glue, the Psiphon iOS app and, last but not
least, the Psiphon iOS browser. This very broad premise and scope explain the
necessity for involving a rather large number of testers with properly matched expertise
in different arenas. In sum, the tests included code audits, actual penetration tests,
protocol and configuration reviews, and a cryptographic audit.
As for the approach, the tests followed a white-box methodology. The Cure53 team was
granted access to the entire Psiphon code base and received pre-built apps. The testers
could consult documentation and set up local and remote test servers to analyze traffic,
server robustness, and the general behaviors of the software compound under stress. In
addition to the software security testing, the cryptographic implementations were given a
thorough review as well. Further, Cure53 looked at the general communication protocol
Psiphon uses, checked the server communications and configurations, and inspected
the library code used by several components.
The tests progressed smoothly. During the process, the Cure53 testing team was in
close contact with the Psiphon team via email. Email communication exchanges were
occasionally used to ask for clarity within the updated documentation and pertained to
requesting minor assistance during the software setup process. Early on, the testers had
shared a conviction that the software compound greatly benefitted from a number of
software security audits in the past. Needless to say, this is reflected in findings. Among
the total nine issues discovered, only two were marked as security vulnerabilities and
were further ascribed with the lowest “Informational” severity ranking. The remaining five
Cure53, Berlin · 12/22/17 2/19
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
findings comprised general weaknesses with similarly minimal bearing on Psiphon’s
overall security. As it stands, a combination of very clean code with a very precise and
specific threat model leaves almost no realistic attack surface for adversaries.
The report will now describe the few findings on a case-by-case basis, then providing an
itemized commentary on the cryptographic realm. In the final section, it will deliver a
conclusion, again elaborating on test coverage and findings. The Cure53 testing team
offers general impressions about the security level of the tested Psiphon software
components in the closing paragraphs.
Note: This report was updated on December 22nd 2017 to reflect all changes between
report submission and release date.
Scope
• Psiphon Client
◦ https://github.com/Psiphon-Labs/psiphon-tunnel-core/tree/master/ConsoleClient
• Psiphon Client & Server Binaries
◦ Binaries and sample configuration files were shared with Cure53
• Psiphon Mobile Binaries
◦ Binaries were shared with Cure53
• Psiphon Server
◦ https://github.com/Psiphon-Labs/psiphon-tunnel-
core/blob/master/Server/README.md
• Psiphon iOS Library
◦ https://github.com/Psiphon-Labs/psiphon-tunnel-
core/tree/master/MobileLibrary/iOS/PsiphonTunnel/PsiphonTunnel
• Psiphon iOS Browser
◦ https://github.com/Psiphon-Inc/endless
Cure53, Berlin · 12/22/17 3/19
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. PSI-01-001) for the purpose of facilitating any
future follow-up correspondence.
PSI-01-001 Browser/Protocol: Server IP Leak via Traffic Fingerprinting (Info)
Update: This will be addressed in future releases.
It was found that the iOS app makes frequent requests to CDN servers. These requests
are easy to identify as they conform to a number of patterns which may be used by a
malicious government or similar parties to block Psiphon servers. More specifically,
heartbeat requests conform to the patterns enumerated below.
1. The requests occur very frequently; when the iOS browser is idle, they occur
every one to five seconds.
2. The response is almost always 135 bytes in length for an empty request when
the browser is idle.
3. The request is always POST, with the same Cookie and Content-Type; it
occasionally switches the Host and User-Agent headers.
4. The host in the Host Header does not correspond to the IP address being
queried and fails to DNS-resolve.
5. When a POST body appears, it is encrypted despite the request being clear-text
HTTP.
Heartbeat requests can be found next.
Request:
POST / HTTP/1.1
Host: www.██████████████████motive.com
User-Agent: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Content-Length: 0
Content-Type: application/octet-stream
Cookie: T=v6UNh9nDupvCw9wZqt-pvA
Connection: close
[...optional encrypted payload here...]
Response:
HTTP/1.1 200 OK
Content-Length: 0
Cure53, Berlin · 12/22/17 4/19
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Content-Type: text/plain; charset=utf-8
Date: Thu, 22 Jun 2017 14:18:50 GMT
Connection: close
It can be observed that the host in th