Penetration Test Report (iSEC): iSEC Cryptocat iOS

Open Technology Fund
CryptoCat iOS
Application Penetration Test
Prepared for:
Prepared by:
Alban Diquet — iSEC Technical Lead
David Thiel — Security Engineer
Scott Stender — Security Engineer
iSECPartnersFinalReport CryptoCatiOS Page  of  
©     ,iSECPartners,Inc.
PreparedbyiSECPartners,Inc.forOpenTechnologyFund.Portionsofthisdocumentandthetemplatesusedin
itsproductionarethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
DocumentChangeLog
Version Date Change
.      -   -   Documentreadyforreadout
.      -   -   Bumpto  .  followingreadout
.      -   -   Clarifications regarding iOS application not being distributed in App Store
duringtesting
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
Table of Contents
ExecutiveSummary ........................................................ 
.  iSECRiskSummary ........................................................... 
.  ProjectSummary ............................................................. 
.  FindingsSummary............................................................ 
.  RecommendationsSummary................................................... 
EngagementStructure .....................................................  
.  InternalandExternalTeams ...................................................  
DetailedFindings ..........................................................  
.  Classifications................................................................  
.  Vulnerabilities ...............................................................  
.  DetailedVulnerabilityList—iOSClient.........................................  
.  DetailedVulnerabilityList—OtherComponents.................................  
Appendices ....................................................................  
A XMPPStartTLSstripping ..................................................  
A.  Screenshot...................................................................  
A.  Pythonscript ................................................................  
B InvisibleChatRoomMember..............................................  
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
Executive Summary
ApplicationSummary
ApplicationName CryptoCat
ApplicationType iOSapplication
Platform iOS
EngagementSummary
Dates January   ,     – February  ,    
ConsultantsEngaged 
TotalEngagementEffort  personweeks
EngagementType ApplicationPenetrationTest
TestingMethodology WhiteBox
VulnerabilitySummary
TotalHighseverityissues 
TotalMediumseverityissues 
TotalLowseverityissues 
TotalInformationalseverityissues 
Totalvulnerabilitiesidentified:  
Seesection  .  onpage   fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 
AuditingandLogging 
Authentication  (cid:4)(cid:4)(cid:4)
Configuration  (cid:4)(cid:4)
Cryptography  (cid:4)
DataExposure  (cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)
DataValidation 
DenialofService  (cid:4)
ErrorReporting 
Patching  (cid:4)(cid:4)
SessionManagement 
Timing 
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
.  iSEC Risk Summary
TheiSECPartnersRiskSummarychartevaluatesdiscoveredvulnerabilitiesaccordingtoestimateduser
risk. The impact of the vulnerabilityincreasestowardsthe bottom of the chart. The sophistication
requiredforanattackertofindandexploittheflawdecreasestowardstheleftofthechart. Thecloser
avulnerabilityistothechartorigin,thegreatertherisktotheuser.
w • iOS client - Public key data logged locally
o
L
• iOS client - Autocorrection leaks
information to disk
• iOS client - Crashes triggered by
malformed multi-party messages
• iOS client - HMAC validation
timing attack
• iOS client - Information leaking
from iOS screenshots
k
s • Weak SSL/TLS versions and cipher
i
R
suites supported by XMPP service
r e • Browser clients - Chat room eavesdropping
s using a regular XMPP client
U • iOS client - Lack of return value
checking for sensitive function calls
• CryptoCat chat rooms log encrypted
messages and can be made persistent
• Browser clients - Misleading
• iOS client - Private messages
security UI for SMP identity checking
h are logged in plaintext
g
iH
• iOS client - XMPP connection • iOS client - Private key stored
vulnerable to StartTLS stripping in plaintext on local storage
• CryptoCat OTR implementation
vulnerable to man-in-the-middle attacks
• CryptoCat’s security model relies on
unrealistic user requirements
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
.  Project Summary
TheOpenTechnologyFund(OTF)engagediSECPartnerstoperformasource-codeassistedsecurity
reviewoftheCryptoCatiOSapplication. Atotalofthreeconsultantsworkedontheprojectbetween
January   thandFebruary  th,     foratotalofthreeperson-weeksofwork. Thissecurityanalysis
wasstructuredas``besteffort''withinthegiventimeframe.
The goal of this engagement was to review the CryptoCat iOS application with a focus on misuse
ofcommoniOSAPIs, flawsinimplementationofcryptographicprotocols, andremotelyexploitable
vulnerabilitiesthatcouldimpacttheconfidentialityorintegrityofCryptoCatchatsessions.
The iSEC team performed the testing of the iOS client using both the iOS simulator and physical
iDevices. iSEC also used CryptoCat browser clients and a third-party XMPP/OTR client  to review
cross-platforminteractionswithinaCryptoCatchatroom.
Itemsthatwereoutofscopeforthisengagementinclude:
• Areviewofthemulti-partycryptographicprotocol.
• TheCryptoCatbrowser,desktopandAndroidclients.
Addendum(  /   /   ): TheiOSapplicationwasin-developmentcodethatattimeoftestingwasavailable
only in a pre-production form on GitHub and not distributed via the App Store. The CryptoCat team
hadtimetoreviewthevulnerabilitiespriortopublicationintheAppStoreandclaimstohaveaddressed
them;however,iSEChasnotvalidatedanyfixesandcannotmakeanyclaimstothecurrentstatusofany
vulnerabilities.
While not in scope for theengagement, iSECalso identified vulnerabilities that pertain to the released
anddeployedbrowserextensionandserverconfiguration. TheseissueswerefoundwhiletestingtheiOS
client'sintegrationwithotherCryptoCatcomponents.
iSECusedtheAdiumchatclient-https://adium.im/
February  ,     OpenTechnologyFund Version  . 
iSECPartnersFinalReport CryptoCatiOS Page  of  
.  Findings Summary
CryptoCat'sgoalofprovidingamessagingsystemthatisbotheasy-to-useandsecureisimportantand
challenging. The issues identified in this report demonstrate several instances in which the design
andimplementationofCryptoCatfailtomeetthisgoal. Infact,duetovulnerabilitiesidentified,the
practicalsecurityofCryptoCatonallplatforms,attimeofreview,iscurrentlyequivalenttoastandard
XMPPclientwithoutOTRandfallsshortofthesecurityprovidedbyanXMPPclientwithOTR.
CryptoCatDesignFlaws
The most serious problems affecting CryptoCat are design issues that diminish the security of all
CryptoCatcommunications.
CryptoCat'sOTRimplementationonallplatformsallowsachatpeertochangetheirOTRkeyduring
achatsessionwithoutusernotification. Anattackerperformingaman-in-the-middleattackagainst
theclient'sXMPPorHTTPSstreamcaninjecttheirownOTRkeyinthediscussionafterauserhas
authenticated their peer's OTR fingerprint. This permits the attacker to decrypt all messages that
follow,andnouserwouldhavereasontosuspectthecompromise. Groupmulti-partydiscussionsdo
notseemtosufferfromthesamevulnerability.
Anotherissueisthatthesecurityofusers'communicationsreliessolelyonmanualverification