Penetration Test Report (Doyensec): Doyensec Basecamp HEY Platform Q32020 SAS

Security Auditing Report
HEY Platform (API, Android, iOS & Desktop Apps)
Q3 2020
Prepared for: Basecamp, LLC
Prepared by: Luca Carettoni
July 22, 2020
WWW.DOYENSEC.COM © DOYENSEC
HEY Platform - Security Auditing Report
Table of Contents
Table of Contents 1
Revision History 2
Contacts 2
Executive Summary 3
Methodology 5
Project Findings 7
Appendix A - Vulnerability Classification 9
Appendix B - Remediation Checklist 10
Appendix C - Hardening Recommendations 12
Appendix D - One-Click RCE, A Case Study 16
1 of 17 WWW.DOYENSEC.COM
HEY Platform - Security Auditing Report
Revision History
Version Date Description Author
Norbert Szetei,
1 07/17/2020 First release of the final report
Lorenzo Stella
2 07/21/2020 Additional editing Luca Carettoni
3 07/22/2020 Appendix D - One-Click RCE, A Case Study Luca Carettoni
4 07/22/2020 Peer review Lorenzo Stella
Contacts
Company Name Email
Basecamp, LLC Jeremy Daer jeremy@basecamp.com
Basecamp, LLC Rosa Gutiérrez rosa@basecamp.com
Doyensec, LLC Luca Carettoni luca@doyensec.com
Doyensec, LLC John Villamil john@doyensec.com
2 of 17 WWW.DOYENSEC.COM
HEY Platform - Security Auditing Report
Executive Summary • HEY for iOS
• com.hey.app.ios
• Version 1.0.5 (184)
Overview • https://github.com/basecamp/hey-ios
Basecamp engaged Doyensec to perform a • HEY for Android
security assessment of the HEY platform. The • com.basecamp.hey
project commenced on 06/29/2020 and ended on • Version 1.0.8 (73)
07/17/2020 requiring 3 security researchers. The • https://github.com/basecamp/haystack-
project resulted in twenty one (21) findings of android
which three (3) were rated as high severity.
• HEY Web Platform
The project consisted of a manual application • Cloned on commit
security assessment against HEY’s web platform #ba365cc40ae523704e1d5aef00d8c43a7
and its APIs, mobile (Android, iOS) and desktop ddc1a0f
(Electron-based) applications. • https://github.com/basecamp/hey-
electron
Testing was conducted remotely from Doyensec
EMEA and US offices. Scoping Restrictions
Scope During the engagement, Doyensec did not
encounter difficulties with testing the application.
Through meetings with Basecamp, the scope of
the project was clearly defined: The following platform features were not yet
available for testing:
• Identify misconfigurations and vulnerabilities
in HEY’s web platform and applications
• Projects management and invitations
• Mobile OAuth design
• Review the overall application design in
terms of security and privacy • Queenbee controller
• /demo, /development, /post_office endpoints
• Evaluate the overall security posture and • Functionality related to custom domains or
security best practices compared to other coworkers (“extenzions’)
similar email management solutions • The “resque_web” directory
• A number of action_mailbox controllers which, at
The testing took place in a production
the time of testing, returned 404 status codes or
environment using the latest version of the
required additional credentials
software at the time of testing.
Testing targeted the https://app.hey.com/ and
This activity was performed on the following
https://hey.com/ domains and focused on
releases:
application security only. Mail-servers’ (Postfix)
configurations and other infrastructural
• HEY for Desktop
components were not considered in scope during
• Version 1.0.9
this security testing effort.
• https://github.com/basecamp/hey-
electron
3 of 17 WWW.DOYENSEC.COM
HEY Platform - Security Auditing Report
Findings Summary
Recommendations
Doyensec researchers discovered and reported
twenty one (21) vulnerabilities in the HEY The following recommendations are proposed
platforms. While most of the issues are based on studying HEY's security posture and the
departures from best practices and low-severity vulnerabilities discovered during this engagement.
flaws, Doyensec identified three (3) issues rated
as high severity, and several other medium Short-term improvements
severity vulnerabilities.
• Work on mitigating the discovered
It is important to reiterate that this report vulnerabilities. Use the Appendix B -
represents a snapshot of the security posture of Remediation Checklist to ensure all areas
the environment at a point in time. have been covered
The findings include a number of information Long-term improvements
exposure vulnerabilities, insecure design, and
security misconfiguration issues found across the • Implement certificate pinning in the HEY
three HEY clients and the main API service, in mobile and desktop clients. We believe that
addition to several medium severity findings such feature is a must-have for a secure email
affecting the multi-factor authentication client
mechanism (2FA bypass), the Gopher caching
service (Server Side Request Forgery, Stored • Migrate the hard-coded credentials in all the
Cross-Site Scripting) and the Android mobile repositories to a secure storage and retrieval
application (Insecure File Content Provider). solution
In Appendix D - One-Click RCE, A Case Study, we • Perform periodic reviews and updates of the
demonstrate how chaining three vulnerabilities client applications’ dependencies in order to
discovered during this engagement would allow mitigate known vulnerabilities
an attacker to compromise the user’s workstation • Optimizing the security of any application
when using HEY for Desktop. involves a compromise with usability. With the
objective of finding such a balance and
Overall, the security posture of the Internet-facing through discussions of this unique threat
APIs was found to be in line with industry best model, Doyensec created the Appendix C -
practices. Hardening Recommendations. We would
recommend review and consideration of our
With the exclusion of the ElectronJs-based suggestions to improve the overall security
application, Doyensec has found the system to be posture of the HEY platform
well architected and resilient to common web/
mobile attacks.
4 of 17 WWW.DOYENSEC.COM
HEY Platform - Security Auditing Report
Methodology • Dex2Jar
• JD-Gui
• Xcode
Overview • Devtron
• Asar
Doyensec treats each engagement as a fluid • Electronegativity
entity. We use a standard base of tools and • Curl, netcat and other Linux utilities
techniques from which we built our own unique
methodology. Our 30 years of information security Web Application and API
experience has taught us that mixing offensive Techniques
and defensive philosophies is the key for standing
against threats, thus we recommend a graybox
Web assessments are centered around the data
approach combining dynamic fault injection with
sent between clients and servers. In this realm,
an in-depth study of source code to maximize the
the principle audit tool is the Burp Suite, however
ROI on bug hunting.
we also use a large set of custom scripts and
extensions to perform specific audit tasks. We
During this assessment, we have employed
focus on authorization, authentication, integrity
standard testing methodologies (e.g., OWASP
and trust. We study how data is interpreted,
Testing guide recommendations) as well as
parsed, stored, and relayed between producers
custom checklists to ensure full coverage of both
and consumers.
code and vulnerabilities classes.
We subvert the client with malicious data through
Setup Phase reflected and DOM based Cross Site Scripting and
by breaking assumptions in trust. We test the
Basecamp provided access to the online server endpoints for injection style flaws
environment, source code repositories and including, but not limited to, SQL, template, XML,
production binaries for the applications. and command injection flaws. We look at each
request and response pair for potential Cross Site
Client application testing was conducted on all Request Forgery and race conditions. We study
the available supported platforms: macOS, the application for subtle logic issues, whether
Windows, Linux, Android, iOS. they are authorization bypasses or insecure
object references. Session storage and retrieval is
scrutinized and us