Penetration Test Report (UnderDefense): Anonymised BlackBox Penetration Testing Report 2018

​
Penetration Testing Report
for
Bitcoin Exchange Company
June 2018
Executive summary
This report presents the results of the “Black Box” penetration testing for Bitcoin exchange
company WEB application.
The recommendations provided in this report structured to facilitate remediation of the identified
security risks. This document serves as a formal letter of attestation for the recent Bitcoin
exchange company black-box penetration test and smart-contract security code review.
Evaluation ratings compare information gathered during the course of the engagement to “best in
class” criteria for security standards. We believe that the statements made in this document
provide an accurate assessment of Bitcoin exchange company current security as it relates to
infrastructure and network perimeter.
We highly recommend to review section of Summary of business risks and High-Level
Recommendations for better understanding of risks and discovered security issues.
Scope Security Grade
level
Web application perimeter Poor D
UnderDefense Grading Criteria:
Grade Security Criteria Description
A Excellent The security exceeds “Industry Best Practice” standards. The overall
posture was found to be excellent with only a few low-risk findings
identified.
B Good The security meets with accepted standards for “Industry Best
Practice.” The overall posture was found to be strong with only a
handful of medium- and low- risk shortcomings identified.
C Fair Current solutions protect some areas of the enterprise from security
issues. Moderate changes are required to elevate the discussed areas
to “Industry Best Practice” standards
D Poor Significant security deficiencies exist. Immediate attention should be
given to the discussed issues to address exposures identified. Major
changes are required to elevate to “Industry Best Practice” standards.
UnderDefense LLC Page 2 of 60
Black Box Penetration Testing Report for Bitcoin exchange company Web
application
F Inadequate Serious security deficiencies exist. Shortcomings were identified
throughout most or even all of the security controls examined.
Improving security will require a major allocation of resources.
Assumptions & Constraints
As the environment changes, and new vulnerabilities and risks are discovered and made public,
an organization’s overall security posture will change. Such changes may affect the validity of this
letter. Therefore, the conclusion reached from our analysis only represents a “snapshot” in time.
Objectives & Scope
Organization Bitcoin exchange company
Audit type Black-box Manual and Automated Penetration Testing of
cryptocurrency exchange and Solidity based Smart-Contract
code review
Asset URL aaaaaaaaaaaaaaaaaaaaa
Audit period May 21 2018-June 8 2018
Consultants performed discovery process to gather information about the target and searched for
information disclosure vulnerabilities. With this data in hand, we conducted the bulk of the testing
manually, which consisted of input validation tests, impersonation (authentication and
authorization) tests, and session state management tests. The purpose of this penetration testing
is to illuminate security risks by leveraging weaknesses within the environment that lead to the
obtainment of unauthorized access and/or the retrieval of sensitive information. The
shortcomings identified during the assessment were used to formulate recommendations and
mitigation strategies for improving the overall security posture.
Results Overview
The test uncovered a few vulnerabilities that may cause full web application compromise, broken
confidentiality and integrity and availability of the resource.
Identified vulnerabilities are easily exploitable and the risk posed by these vulnerabilities can
cause significant damage to the application.
UnderDefense Security team also discovered 34 risks and potential vulnerabilities in
Smart-Contract Solidity based code. More details about findings in this section can be find in
Appendix B of this report.
UnderDefense LLC Page 3 of 60
Black Box Penetration Testing Report for Bitcoin exchange company Web
application
Security experts performed manual security testing according to OWASP Web Application
Testing Methodology, which demonstrate the following results.
Severity Critical High Medium Low Informational
# of issues 2 4 8 3 3
Severity scoring:
● Critical​ - ​Immediate threat to key business processes.
● High​ – Direct threat to key business processes.
● Medium – Indirect threat to key business processes or partial threat to business
processes.
● Low​ – No direct threat exists. Vulnerability may be exploited using other vulnerabilities.
● Informational – This finding does not indicate vulnerability, but states a comment that
notifies about design flaws and improper implementation that might cause a problem in
the long run.
UnderDefense LLC Page 4 of 60
Black Box Penetration Testing Report for Bitcoin exchange company Web
application
Summary of business risks
Critical severity issues are an immediate threat to key business process and requires immediate
remediation as they lead to:
● Access to administrative account and consequently, confidentiality, integrity and even
availability of the sensitive data, like list of users, their transactions, their money, could be
broken. When admin account is compromised whole web application could be
compromised, which may lead to huge reputational damage, loss of clients trust and
money loss. This is also huge reputation risk.
● API keys could be stolen fairly easy and without direct user interaction, and these leads to
full access to user account data, malicious money transfers, etc. Attacker can easily steal
money, for instance by exchanging them to bitcoin and after then withdrawing them to
different bitcoin account. This cause financial and reputational impact, loss of client
database and appearing in the news in a bad light, like it happened with ​aaaaaaa​, ​aaaaaaa​,
aaaaaaa​ and many others.
High severity issues make direct threat to the business as they can be used to:
● Using outdated software with known DoS vulnerability with publicly available exploit,
makes direct threat to availability of the service. This may lead to money loss due to web
application inactivity and users’ inability to reach desirable service. Every hour of
unavailability of service will cost business some amount of money, losses in revenue,
client complains and avoidance of using a platform for further financial transaction.
● Not encrypted communication leads to different sort of eavesdropping and modifying
data on it’s way from client to server or on the opposite way. Moreover, transfering users’
credential and private API keys over unencrypted channel makes it easy to steal them and
afterwards, leads to user account compromise.
● Outdated Redis Database without password protected access gives the attacker the
opportunity to get unauthorised access to sensitive data. Which may lead to sensitive
information leakage and brakes the integrity of data, which is stored on dedicated
database. Attackers can modify records in the database and no one will notice it.
● Lack of sanitization of user input data on the server side may lead to sensitive data leakage
and in case of stealing API keys, even user compromise.
Medium and low severity issues can lead to:
● Attacks on communication channels and as a result on sensitive data leakage and possible
modification, in other words it affects integrity and confidentiality of data transferred.
● Leakage information about valid users of the system, with afterwards may be used in
further attacks for brute forcing passwords or social engineering,
● Host header poisoning attack may be used to generate malformed password reset link,
resulting in access to users’ data.
UnderDefense LLC Page 5 of 60
Black Box Penetration Testing Report for Bitcoin exchange company Web
application
High-Level Recommendations
Taking into consideration all issues that have been discovered, we highly recommen