Penetration Test Report (iSEC): OTF Security Audit Review

Open Technology Fund
Security Audit Review
Prepared for:
Radio Free Asia’s Open Technology Fund
Prepared by:
Tom Ritter – Principal Security Consultant, iSECpartners
iSEC Partners Report – Open Technology Fund Security Audit Page 2 of 30
©2013, iSEC Partners, Inc.
Prepared by iSEC Partners, Inc. for Open Technology Fund. Portions of this document and the
templates used in its production are the property of iSEC Partners, Inc. and cannot be copied
without permission.
While precautions have been taken in the preparation of this document, iSEC Partners, Inc, the
publisher, and the author(s) assume no responsibility for errors, omissions, or for damages re-­‐
sulting from the use of the information contained herein. Use of iSEC Partners services does
not guarantee the security of a system, or that computer intrusions will not occur.
October 21, 2013 Open Technology Fund Version 1.2
iSEC Partners Report – Open Technology Fund Security Audit Page 3 of 30
Table of Contents
1 Executive Summary ............................................................... 5
2 Introduction .......................................................................... 6
3 Methodology ......................................................................... 8
4 Categories of Concern .......................................................... 11
4.1 Categories ........................................................................................................... 11
4.2 OTF Supported Projects .................................................................................... 21
5 Observations ....................................................................... 26
5.1 Scope .................................................................................................................. 26
5.2 Recommendations ............................................................................................. 26
5.3 Categories .......................................................................................................... 26
5.4 OTF Supported Projects ................................................................................... 27
6 Suggestions for the Future ................................................. 28
6.1 Scope .................................................................................................................. 28
6.2 Recommendations ............................................................................................. 28
6.3 Specific Areas of Concern ................................................................................. 29
6.4 Auditor Selection Criteria ................................................................................. 30
iSEC Partners Report – Open Technology Fund Security Audit Page 4 of 30
iSEC Partners Report – Open Technology Fund Security Audit Page 5 of 30
1 Executive Summary
Open Technology Fund (OTF) finances technologies that promote human rights and Internet
freedom globally. As a funder of emerging technology, OTF is interested in keeping the quality
of its investments high. One component of ensuring its projects meet the highest information
security standards includes facilitating independent technology audits. Accordingly, OTF con-­‐
tracts information security auditors to assess the privacy and security limitations in OTF-­‐
funded projects and suggest remedial recommendations. These audits both mitigate risk inher-­‐
ent in funding cutting-­‐edge technologies and strengthen the technical capacity of OTF sup-­‐
ported projects and the broader human rights and Internet freedom technology community.
To derive the greatest possible value from these audits, OTF has sought to identify a process by
which to evaluate technical security audit reports from the perspective of a funder, not a tech-­‐
nologist. This document provides a framework for how an organization, such as a human rights
funder or an NGO, can effectively and efficiently engage information security auditors, based
on OTF’s experience and findings.
Specifically, Section 2 introduces the Open Technology Fund, its security audit process, and
defines terminology used through the document. Section 3 provides a methodology for work-­‐
ing with information security auditors and assessing security audit reports. In Section 4 we
identify areas of inadequacies, problems, or concerns we expect an auditor to evaluate, along
with other criteria we expect security auditors to meet, such as recommendations for reducing
security vulnerabilities in the future. Section 5 contains the results of OTF security audits,
summing up individual reports, identifying best and worst practices, and common themes. The
conclusion in Section 6 provides suggestions for interviewing and selecting an audit firm, and
offers specific recommendations for OTF, although useful for other organizations, to improve
its information security audit process. Finally, appendices and attachments include worksheets,
checklists, and templates used by OTF that may assist other organizations with similar needs.
iSEC Partners Report – Open Technology Fund Security Audit Page 6 of 30
2 Introduction
Open Technology Fund (OTF) uses public funds to support projects that develop open and
accessible technologies promoting human rights and open societies. Its funds are delivered as
contracts promoting research, deployment, and implementation of applications promoting
Internet freedom. A portion of these funds are also paid to security audit firms to conduct re-­‐
views of OTF-­‐funded applications. The security audit firms review the applications to identify
specific exploitable vulnerabilities, suggest fixes, and provide recommendations for preventing
future flaws and improving the overall privacy and security of the application. This is often
termed as “defense in depth”. Further, increasing the number of high quality information secu-­‐
rity audits provides sustenance to the growing field of human rights and technology.
This document reviews the breadth, scope, and coverage of security audits performed on OTF
funded applications to date. Its goal is to identify the strengths and shortcomings in OTF’s cur-­‐
rent process. Further, it will provide recommendations to improve the breadth of coverage and
to derive greater future value. iSEC Partners was chosen as a partner for this report due to its
unique experience evaluating and contributing to Internet freedom technologies.1
This report presents a methodology to assess multiple audit firms producing multiple reports
testing multiple applications and evaluates sixteen OTF-­‐sponsored audits. Within are defini-­‐
tions of evaluation categories that auditors and funders should consider and commonalities
observed between these categories and between audit firms. Finally, the report provides OTF
with suggestions aimed to derive greater value from future audits.
Through the document, the following terminology is used:
• Project is used to refer to the team of individuals receiving funds from RFA
• Project’s Application, or just application, is used to refer to the specific application
or tool funded by OTF. Projects may be working on multiple applications, not all of
which are funded by OTF.
• An Audit is an evaluation or assessment of the security of an application. It identifies
vulnerabilities and insecure design decisions and provides recommendations to fix the
flaws and improve security.
• Auditor is used to denote the individual or organization performing the audit for a
specific application.
• Funder is used to denote an organization that subsidizes security audits for an appli-­‐
cation. In this report it refers to OTF – but we aim to provide a methodology and rec-­‐
ommendations that can be used by different funding entities.
1 LibTech-­‐Auditing-­‐Cheatsheet -­‐ https://github.com/iSECPartners/LibTech-­‐Auditing-­‐
Cheatsheet
iSEC Partners Report – Open Technology Fund Security Audit Page 7 of 30
A note on confidentiality and original audit r