Penetration Test Report (iSEC): Psiphon 3 iSEC Partners v1.1 08 2014

Psiphon Inc.
Psiphon 3
Security Assessment
Prepared for:
Prepared by:
Mark Manning — Security Engineer
Anson Gomes — Security Engineer
Andrew Rahimi — Security Engineer
iSECPartnersFinalReport—Psiphon3 Page2of28
©2014,iSECPartners,Inc.
PreparedbyiSECPartners,Inc.forPsiphon.Portionsofthisdocumentandthetemplatesusedinitsproduction
arethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
August22,2014 OpenTechnologyFund Version1.1
iSECPartnersFinalReport—Psiphon3 Page3of28
Table of Contents
1 ExecutiveSummary ........................................................ 4
1.1 iSECRiskSummary ........................................................... 5
1.2 ProjectSummary ............................................................. 6
1.3 FindingsSummary............................................................ 6
1.4 RecommendationsSummary................................................... 7
2 EngagementStructure ..................................................... 8
2.1 InternalandExternalTeams ................................................... 8
2.2 ProjectGoalsandScope ....................................................... 9
3 DetailedFindings .......................................................... 12
3.1 Classifications................................................................ 12
3.2 Vulnerabilities ............................................................... 14
3.3 DetailedVulnerabilityList ..................................................... 15
Appendices .................................................................... 26
A ImprovementstoHostManagement ...................................... 26
A.1 LogAggregationandSIEM..................................................... 26
B AuthorizationandAuthenticationControls .............................. 27
B.1 PsiopsDatabaseManagement .................................................. 27
B.2 RemoteAdministration........................................................ 27
C HostHardening ............................................................ 28
August22,2014 OpenTechnologyFund Version1.1
iSECPartnersFinalReport—Psiphon3 Page4of28
1 Executive Summary
ApplicationSummary
ApplicationName Psiphon3
ApplicationVersion 3.0-ClientVersion: 78
ApplicationType WindowsandAndroidClients
Platform Python,C++,Debian6&7,Ubuntu14
EngagementSummary
Dates July21,2014– August22,2014
ConsultantsEngaged Three
TotalEngagementEffort Sixperson-weeks
EngagementType SecurityAssessment
TestingMethodology WhiteBox
VulnerabilitySummary
TotalHighseverityissues 1
TotalMediumseverityissues 1
TotalLowseverityissues 3
TotalInformationalseverityissues 6
Totalvulnerabilitiesidentified: 11
Seesection3.1onpage12fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 0
AuditingandLogging 0
Authentication 0
Configuration 8 (cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)
Cryptography 0
DataExposure 1 (cid:4)
DataValidation 0
DenialofService 0
ErrorReporting 0
Patching 2 (cid:4)(cid:4)
SessionManagement 0
Timing 0
August22,2014 OpenTechnologyFund Version1.1
iSECPartnersFinalReport—Psiphon3 Page5of28
1.1 iSEC Risk Summary
TheiSECPartnersRiskSummarychartevaluatesdiscoveredvulnerabilitiesaccordingtouserrisk. The
impactofthevulnerabilityincreasestowardsthebottomofthechart. Thesophisticationrequiredfor
anattackertofindandexploittheflawdecreasestowardstheleftofthechart.Thecloseravulnerability
istothechartorigin,thegreatertherisktoPsiphonusers.
• Hosts running unnecessary services as “root”
• Unnecessary applications installed on servers
w
o
L
• Admin SSH login via username and password
• Windows client persists settings in Registry
• Insecure default Android browser settings
k
s
i
R
• Root logins allowed on Psiphon servers
s
s
e
n
i
s
u
B
h
g
iH
• Missing patches and security updates
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
August22,2014 OpenTechnologyFund Version1.1
iSECPartnersFinalReport—Psiphon3 Page6of28
1.2 Project Summary
OpenTechnologyFund1engagediSECPartners(iSEC),anNCCGroupcompany,toperformasecurity
assessmentforPsiphonInc. (Psiphon)toevaluatetheirPsiphon3software. ThePsiphonsoftwareis
designedforcensorshipcircumventionthroughtheuseofVPN,SSH,ObfuscatedSSH(OSSH),and
HTTP/SOCKSProxytechnologiestobypassenforcedrestrictionsandprovideuserswithuncensored
accesstoInternetcontent. Theendgoalofwhichistoprovideresidentsofcensoredstatesawayto
gainunfetteredaccesstotheInternet.
ThePsiphon3softwarehasnumerouscomponentsthatweredeemedinscopefortheengagement.
TheseincludedthePsiphonAndroidandWindowsclients,Psiphonserverconfiguration,fingerprint-
ingdefensemechanism,OSSHprotocol,automationserver,feedbacksystem,andstatstracking.
ThreeiSECconsultantsworkedforatotalofsixperson-weeksandcompletedtheengagementacross
three calendar-weeks that started on July 21, 2014 and ended on August 22, 2014, with breaks in
between. The engagement was white box in nature and Psiphon provided iSEC with source code,
testclientsforAndroidandWindows,andcredentialstoaccessadedicatedPsiphonserver.
TheengagementbeganwithashortarchitecturereviewusingdocumentationprovidedbythePsiphon
teamandinformationgarneredthroughtechnicalinterviewsconductedwiththevariousteammem-
bers. ThiswasfollowedbyareviewofthePsiphonserverconfigurationsandsubsequentlyanassess-
mentofthesecurityofthePsiphonAndroidapplication.
LaterphasesoftheprojectexpandedthetestingteamandfocusedonassessingthePsiphonWindows
client, analyzingnetworktraffic, andassessingtheserverdiscoveryprotocol. AreviewoftheOSSH
handshakeimplementationwasalsoperformedandiSECperformedacursoryanalysisofthePsiphon
automationscriptsthatareusedforservermanagementandotherinfrastructurelogistics.
The Psiphon team was very helpful during the testing process. The team made themselves readily
availabletorespondtoqueriesandresolvedanyissuesordifficultiesthatwereencounteredduringthe
testingphase.
1.3 Findings Summary
Thefollowingreportreflectsthatduringtheassessment,iSECidentifiedmanyareaswherethePsiphon
team was following industry best practices, or were properly mitigating any threats. Many of the
findingsidentifiedareconsideredassuggestedimprovementstoadefense-in-depthapproachtotheir
system. Noinherentarchitectureflawswereidentifiedduringthetestingperiodandthedevelopers
haveshowntobeactivelyinvestedinensuringthesecurityoftheirusers.
As Psiphon continues to grow both from an organizational perspective and in infrastructure, their
resourcesmaybedifficulttoscale. Forthisreason,iSEChasmaderecommendationsthatcanassistin
theirgrowthandbelievesthattheimprovementstologging,hostsecurity,andmanagementwillhelp
allowthegrouptoexpandwhileminimizingtheriskofaffectingtheirsecurityposture.
1https://www.opentechfund.org/
August22,2014 OpenTechnologyFund Version1.1
iSECPartnersFinalReport—Psiphon3 Page7of28
1.4 Recommendations Summary
Ingeneral,PsiphonshouldcontinuetoinvesttimehardeningthehoststhatarerunningthePsiphon
tools. Thisincludesthesupportinginfrastructureliketheautomaticemailresponderaswellastheir
coreoperatingenvironmentthatrunsthePsiphon3suiteofservices. Theorganizationshouldalso
starttomakeenterprise-gradeimprovementstothewayserversaremanagedaswellasmakingita
goaltohaveabetterperspectiveofwhattypesofattacksoccur,real-time,onthenetwork.
ShortTerm
Shorttermrecommendationsaremeanttoberelativelyeasilyexecutedactions,suchasconfiguration
changes or file deletions that resolve security vulnerabilities. These may also include more difficult
actionsthatshouldbetakenimmediatelytoresolvehigh-riskvulnerabilities.Thisareaisasummaryof
shorttermrecommendations;additionalrecommendationscanbefoundinthevulnerabilitiessection.
KeepPsiphonserverspatchedandupdated. Ensurethatallsystemsstayuptoda