Penetration Test Report (CertiK): BHP Mobile Wallet Penetration Test Report 01 09 2021

BHP Mobile Wallet
Security Assessment
Initial Report: December 30th, 2020
First Revision: January 8th, 2021
For :
BHP Network
Confidentiality Statement
All information contained in this document is provided in confidence for the sole purpose of
adjudication of the document and shall not be published or disclosed wholly or in part to any
other party without CertiK's prior permission in writing and shall be held in safe custody. These
obligations shall not apply to information that is published or becomes known legitimately from
some source other than CertiK.
All transactions are subject to the appropriate CertiK Standard Terms and Conditions. Certain
information given in connection with this proposal is marked “In Commercial Confidence”. That
information is communicated in confidence, and disclosure of it to any person other than with
CertiK’s consent will be a breach of confidence actionable on the part of CertiK.
Disclaimer
This document is provided for information purposes only. CertiK accepts no responsibility for
any errors or omissions that it may contain.
This document is provided without warranty of any kind, express or implied, including but not
limited to the warranties of merchantability, fitness for a particular purpose and non-
infringement. In no event shall CertiK be liable for any claim, damages or other liability (either
direct or indirect or consequential), whether in an action of contract, tort or otherwise, arising
from, out of or in connection with this document or the contents thereof.
This document represents our budgetary price proposal for the solution further described in
this herein and is provided for information and evaluation purposes only and is not currently a
formal offer capable of acceptance.
Overview
Scope
At the start of the engagement, CertiK worked with BHP Network to identify the target and set
the limits on the scope of the test. A White Box type of testing approach was done where
CertiK performed the test with the source code available from the public bhp-wallet GitHub
repository.
Application Name BHP mobile wallet
Codebase GitHub Repository
Commits 507267efa3d788ce4c72821e4efeb3e534d9df16
Updated Commits 8d2c8ac4229d21b618264c38f4dff8ca854c179a
Audit Summary
Delivery Date Dec. 30, 2020
Method of Audit Static Analysis, Dynamic Testing
Consultants Engaged 2
Timeline Dec. 22, 2020 - Dec. 30, 2020
Vulnerability Summary
Total Issues 9
Total Meduim 3
Total Low 3
Total Informational 3
Executive Summary
BHP Network engaged CertiK to perform an application penetration test for their mobile wallet.
The main objective of the engagement is to test the overall resiliency of the application to
various real-world attacks against the application’s controls and functions, and thereby be able
to identify its weaknesses and provide recommendations to fix and improve its overall security
posture.
CertiK started the test on December 22, 2020 and completed on December 30, 2020.
After a thorough review of the updated application, CertiK believes that the BHP application is
currently at a low risk level. Given the severity of the vulnerabilities on the application, it is
unlikely that the application will be directly compromised.
BHP has worked diligently to remediate security vulnerabilities discovered by CertiK,
significantly increasing the overall security posture of their application. Note that because the
mobile application is built with the "uni-app(https://uniapp.dcloud.io/)" framework, some
findings can't be directly addressed. In the long term, we recommend the application switch to
native apps to take advantage of native APIs to further secure the application.
Findings
ID Title Severity Vulnerability Status
Class
BHP-01 Unnecessary Medium Security Fixed
App permissions Misconfiguration
BHP-02 Custom Medium Information Partially Fixed
keyboards not Disclosure
disabled in BHP
wallet
BHP-03 Information Low Information Open
leakage via Disclosure
screenshot
backgrounding
BHP-04 No root or Informational Reverse Open
jailbreak Engineering and
detection on Code Tampering
Android/iOS
application
BHP-05 Ineffective and Low Logic Flaws Fixed
problematic
"confirm
password"
implmentation
BHP-06 Insecure Informational Security Fixed
minimum Misconfiguration
Android SDK
version
BHP-07 Bad Medium Insufficient Fixed
cryptography Cryptography
implementation
BHP-08 Mnemonic Informational Information Open
display allow Disclosure
screenshot
BHP-09 Uses of insecure Low Security Open
protocol Misconfiguration
BHP-01: Unnecessary App permissions
Severity: Medium
Description
When analyzing the AndroidManifest.xml file in the Android APK, we found that the
application requests access to an extensive amount of unnecessary permissions than it
requires. Specifically, the application requests the following unnecessary permissions:
In AndroidManifest.xml
<uses-permission android:name="android.permission.CALL_PHONE" />
<uses-permission android:name="android.permission.MOUNT_UNMOUNT_FILESYSTEMS"
/>
<uses-permission android:name="android.permission.READ_LOGS" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.READ_CONTACTS"/>
<uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
<uses-permission android:name="android.permission.RECORD_AUDIO" />
Impact
The "android:minSdkVersion=19" in AndroidManifest.xml indicates the minimal SDK version to
run the application is 19. Android grants permissions to the application during installation on
devices with SDK version lower than 23. If a user installs the application on such a device, the
application will grant more permission than it should. Furthermore, when the BHP application
is launched for the first time, the application requires users to allow the wallet to make and
manage phone calls, as shown in the "Evidence" section. However, we found no features in
the application that would require the "CALL_PHONE" permission.
Requesting permissions that are not needed by the application could negatively impact the
application's user experience and may degrade the application's public reputation.
Evidence
Recommendation
Permission requests protect sensitive information available from a device and should only be
used when access to information is necessary for the functioning of the application.
We recommend the following when dealing with Android permissions:
Only require the permissions necessary for the application to work.
While making a permissions request, be clear about what permission the application is
accessing and why the application needs that permission.
Provide continuous indications while accessing sensitive capabilities. Make it clear to the
user when the application is collecting data and avoid the perception that the application
is collecting data surreptitiously.
For more information about Android application permission and its best practices, please visit
"https://developer.android.com/training/permissions/usage-notes"
BHP-02: Custom keyboards not disabled in BHP
wallet
Severity: Medium
Description:
The BHP client does not disable custom keyboards. Since a long time ago, users have been
able to install custom keyboards that can be used in any app, replacing the system's default
keyboard. Custom keyboards can, and very frequently do, log and exfiltrate the data users
enter.
The custom keyboard is allowed to use in the mnemonic input field in the BHP application.
Malicious third-party keyboards can log and exfiltrate users' mnemonic. The attacker would
then have total control over the victim's wallet account.
Exploit Scenario
Bob installed a custom keyboard that logs and exfiltrates data he enters on his device. Bob
enters his wallet mnemonic with the custom keyboard, and his mnemonic can be collected by
the third party keyboard.
Recommendation
We have no information regarding how the app artifact(APK and iPA) is built, as ther