Penetration Test Report (Cure53): analysis report bxaq

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Analysis-Report Chinese Police App “BXAQ” 03.2019
By Cure53 (various members of the Cure53 team contributed to this report)
Index
Introduction
Scope of the Assessment
Classification of Findings
Questions & Answers
BXA-01-001 Information gathering (Proven)
BXA-01-002 File transmission and protection (Proven)
BXA-01-003 Pre-processing/MD5 hashing of files and applications (Assumed)
BXA-01-004 Code Execution and Backdoors (Unclear)
BXA-01-005 Similarities & differences between BXAQ, JingWang & IJOP (Assumed)
Conclusions
Appendix
Appendix 1: ZIP uploaded by the BXAQ app; contains all captured information
Appendix 2: cjlog.txt is left on the device after a scan
Appendix 3: cjlog_plain.txt contains the unencrypted data of cjlog.txt:
Introduction
This report documents the findings of a Cure53 assessment targeting the integrated
BXAQ mobile application. The project was requested and funded by the Open
Technology Fund (OTF) with the main objective of finding out whether the BXAQ mobile
application violates human rights. This corresponds to previous analyzes commissioned
by the OTF team in this realm, especially in checking how the BXAQ app relates to the
previously examined JingWang and IJOP projects.
In terms of specific tasks and timeline, Cure53 carried out a source code audit and a
dedicated review of the BXAQ mobile application in late March 2019. The project
followed a so-called white-box methodology as much as possible, particularly in the
sense that the test-targets entailed decompiled source code of the application, which
had been made available to Cure53 as an APK file by the OTF team.
Cure53, Berlin · 07/05/19 1/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
The assessment took a total of ten days, excluding a separate budget allocated to
preparations, communications and write-up of this report. Note that the project was
executed stealthily, i.e. the Cure53 team aimed at avoiding detection. This meant
refraining from any form of behavior that could be perceived as “noisy” and, thus, alert
the maintainers of the application and/or server owners. As noted above, the
assessment tackled both the source code and the running application. Throughout this
assignment, the Cure53 and the OTF team maintained frequent contact on a shared
Slack channel. This allowed for fast messaging and a good flow during the test,
additionally ascertaining that Cure53 does not pursue exploration avenues and
directions useless from the OTF’s point of view.
In should be emphasized that the European Convention on Human Rights (ECHR)
served as a baseline for this project in that Cure53 set out to determine - through the
technical reviews and audits - whether (and which) communication capabilities and
functionality of the BXAQ mobile application can be seen as directly contradicting what
the ECHR guarantees. Therefore, this was a search for any human rights violations that
the operational scope of BXAQ could enable and facilitate.
For the purpose of documenting the findings, Cure53 devised a classification system
that could help discern the level of harm and certainty about each potential violation of
human rights. This system is discussed in more detail below. At this stage, it can
nevertheless be stated that Cure53 managed to prove two cases of clear human rights
(HR) violations. All other items, grouped in an array of five discoveries, should also be
considered, yet only in the context of having all vital information at hand.
In the following sections, the report first elaborates on the scope and then sheds light on
the link between severities of the findings and the employed classification system. The
questions posed by OTF, along with detailed answers and research results, are
discussed next. Further, Cure53 reiterates some of the key points in the Conclusions
and, last but not least, supplies various relevant material in the Appendix. It is hoped that
this will facilitate further research or other actions to be taken by either OTF or any other
- involved or interested – parties.
Cure53, Berlin · 07/05/19 2/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope of the Assessment
• BXAQ Chinese Police App
◦ The assessment focused on the mobile application for Android phones. The
application - labelled as BXAQ - is supposedly used in specific regions of China by
Law Enforcement personnel to gather and manage data about specific groups of
citizens and/or minorities.
◦ In a nutshell, Cure53 got access to the APK of the app through OTF and was tasked
with finding out whether the app is novel or has been analyzed before. If proven to
be new, Cure53 was to find out what the app is capable of.
◦ Of particular importance was the question of the activities and features of the app
that could be used in a way that violated human rights. It was assumed that the app
would be forcefully or secretly installed by local authorities on citizens’ phones.
◦ Cure53 received a briefing and all of the already existing documentation about the
context of this assessment from OTF. Communications ensued in the
aforementioned Slack channel.
Classification of Findings
During this assessment, Cure53 team has been using the following classification to
specify the level of certainty regarding the documented findings. Given that this research
had to happen on the basis of reverse-engineering and needed to be executed in a
stealthy manner, it is necessary to classify the findings to make sure which level of
reliability can be assumed.
• Proven - Source code and the analyzed activity clearly indicate a HR violation.
• Evident - Source code strongly suggests a HR violation.
• Assumed - Indications of a HR violation were found but a broader context
remains unknown.
• Unclear - Initial suspicion was not confirmed. No HR violation can be assumed.
Questions & Answers
OTF and Cure53 had frequent discussions throughout the project. The research results
have been shared and commented, usually in real-time. In addition to the reverse-
engineering of the app’s features as a means to find human rights violations, Cure53
was also tasked with answering specific questions sent in by the OTF team. To fully
cover the scope of the assessment and all related exchanges, the questions asked by
OTF are incorporated into this report. Cure53’s research-based responses can be found
in the ensuing sections.
Cure53, Berlin · 07/05/19 3/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
BXA-01-001 Information gathering (Proven)
The questions posed by the OTF team were as follows:
Q1: “What files/information is gathered by the app?”
The following information is gathered:
• All calendar entries, phone contacts, country codes and dialed numbers;
• General information about the Phone (IMEI, IMSI, PhoneSN, WifiMac,
BluetoothMac, and if the device is rooted);
• Information about the Android Model (CPU_ABI, BOARD, HARDWARE);
• All stored text messages (SMS);
• Information about the current base-station;
• Information about the used hardware (Mac Addresses);
• All information accessible for various installed apps + an MD5 hash of the app;
• Mac Addresses;
• Current phone number;
• Extracted information searched by the GetVirAccount application which searches
the /sdcard for specific data of specific China-related apps. This information
contains phone numbers and email addresses.
Affected File:
com/fenghuo/utils/Global.java
The list was compiled based on the information contained in the files, as well as by
inspecting the generated report.
GetVirAccount is one of the applications shipped by the police-app. During the
installation process they are extracted and stored in the apps data storage. The
GetVirAccount gets executed by the app. GetVirAccount parses the id.conf file, which is
shipped by the app