Penetration Test Report (Cure53): pentest report smartsheriff

Pentest-Report Smart Sheriff 07.2015
Cure53, Dr.-Ing. M. Heiderich, Fabian Fäßler, Dipl.-Ing. Abraham Aranguren
Index
Introduction
Scope
Identified Vulnerabilities
SMS -01-001 Possible Remote Code Execution via MitM in WebView ( Critica l)
SMS -01-002 Possible Filter - Bypass via usafe URL check ( Medium )
SMS -01-003 No use o f any SSL / TLS - based transpor t security ( High )
SMS -01-004 Smar t Sherif f Tes t - Page leaks Data and Application - Internals ( Medium )
SMS -01-005 Insufficien t cryptographic XOR Protection for sensitive Data ( High )
SMS -01-006 Smar t Sherif f AP I allows universa l Password Leak ( Critica l)
SMS -01-007 Smar t Sherif f leaks paren t phone numbers ( Medium )
SMS -01-008 Reflected XSS via CHILD _ MOBILE on ssweb . moiba . or . kr ( Medium )
SMS -01-012 Unsafe Mobile App Data Storage on SD Card ( High )
SMS -01-014 Complete lack o f crypto storage protections on Mobile app ( Medium )
SMS -01-015 AP I leaks Persona l data o f Users o f the Child - App ( High )
SMS -01-016 Modifying Child - App Protection Settings ( Medium )
SMS -01-017 Faking Child ’ s Phone Usage ( High )
SMS -01-018 Complete lack o f authentication on mos t AP I calls ( Critica l)
Miscellaneous Issues
SMS -01-009 Multiple TLS Misconfiguration issues ( Info )
SMS -01-010 Multiple Instances o f outdated Software on AP I Servers ( Medium )
SMS -01-011 Mobile App exposes Tes t - Servers and Debug Tools ( Info )
SMS -01-013 Multiple Insecure Concatenations on Mobile app ( Medium )
Conclusion
1/16
Introduction
“In South Korea, the media regulator is bringing in a controversial new rule for
smartphones purchased for use by anyone under the age of 19 - the installation of
Smart Sheriff, an app which monitors Web browsing on the device, blocks websites that
appear on a banned list, and will alert parents to the use of certain keywords.”
From http :/ / www . digitaltrends . com / mobile / smar t - sherif f - tracker - app - south - korea /
“An activist organization, Open Net Korea, has called the app the equivalent of installing
surveillance cameras in teenagers's phones, without public consultation, and is
challenging the regulation in court. There are concerns that introduction of the app for
teenagers is only the first step, preparing the ground for introduction of a similar app for
adults. As of June 2015 the app has been downloaded about 500,000 times.”
From https :/ / en . wikipedia . org / wik i / Smar t _ Sheriff
This penetration test against the Smart Sheriff android app was carried out by three
testers of the Cure53 team and took four days total to complete. The test was initiated by
the Open Technology Fund, and, importantly, the owner and maintainer of the Smart
Sheriff app, MOIBA, was not informed about this test. The team did not get access to
the sources of the app but had to first retrieve the APK1 from a Korean APK download
service, deflate the file, decompile the DEX file2 and then analyze the resulting sources.
The Smart Sheriff app intends to allow parents to surveil and control the activities of their
children (as mandated by the South Korean government, which means that even young
adults up to the age of nineteen are subject to this regulation). The app consists of two
components, namely the “parent-app” and the “child-app”. The parent-app gets to “know”
the phone on which the child-app is installed on. After registering the child-app, the
“parent-app” can conduct surveillance and manipulate the way that the person running
the child-app is using the phone and control the availability of various Internet services.
Although the test was planned as a short assessment aiming to identify low hanging
fruit, the final result comprises an overall of eighteen individual issues. Several of them
were crucial and classified as critical. This number outlines the catastrophic state of
application and server-security exposed by the app and the connected APIs. The app
can by no means by recommended for use as the identified security vulnerabilities allow
for trivial remote exploitation, severe information leakage, and privacy breaches. Anyone
using the app, be it the parent-app or the child-app, is accepting a huge security risk and
essentially exposes the entirety of the phone and all of its contained data to attacks
involving data theft, manipulation, phone takeover and similar problems. A remote
attacker only needs to know or guess (brute-force) a phone number of one or many
targeted people running the app. This is basically all that is needed to be able to gain full
control over the targeted phone(s).
1 https :// en . wikipedia . org / wik i / Android _ application _ package
2 https :// source . android . com / devices / tech / dalvik / dex - format .html
2/16
The test has confirmed and proven the substantially important assumption that the
Smart Sheriff app was written without any security in mind. The connected API services
are architectured and implemented in similarly horrendous ways, allowing trivial
exposure of passwords and other highly sensitive user data and PII.3 Given the level of
vulnerability this app exposes, combined with extremely high numbers of its users, it
needs to be considered that at least some of the issues published in this report must
have started to be actively exploited by now.
Scope
• Smart Sheriff APK
• Smart Sheriff Decompiled Sources
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
(e.g. SMS-01-00X) for the purpose of facilitating any future follow-up correspondence.
SMS-01-001 Possible Remote Code Execution via MitM in WebView (Critical)
After downloading the APK and decompiling the DEX file, a simple full-text search
unveiled the first critical security issue. This vulnerability allows an attacker to get control
over a phone running the Smart Sheriff app by abusing insecure usage of Android’s
JavaScript Interfaces for WebViews.4
Affected Code (decompiled source):
Object obj1 = "http://ssweb.moiba.or.kr/pushAlarm";
_L6:
WebView webview = (WebView)findViewById(0x7f070000);
webview.setWebViewClient(new l(this));
webview.getSettings().setJavaScriptEnabled(true);
webview.getSettings().setSavePassword(false);
webview.getSettings().setSaveFormData(false);
webview.addJavascriptInterface(new JavaScriptInterface(),
"SmartSheriff");
webview.setWebChromeClient(new kr.co.wigsys.sheriff.ui.f(this));
webview.postUrl(((String) (obj1)), ((String) (obj)).getBytes());
Given that all network traffic between the app and the MOIBA API servers is locked to
use HTTP, a MitM attack5 can be trivially executed by any attacker who manages to lure
a victim into a malicious WiFi network.
3 https :// en . wikipedia . org / wik i / Personally _ identifiable _ information
4 http :// developer . android . com / reference / android / webkit / JavascriptInterface .html
5 https :// en . wikipedia . org / wik i / Man - in - the - middle _ attack
3/16
Consequently, a reliable and simple to use remote code execution vector6 is achieved.
Note, however, that the affected versions of Android range from 2.4 to 4.1 (API Level 17,
included). Later versions are only affected if a public method is annotated with
@JavaScriptInterface, which is not the case for this app as far as the decompiled
sources indicated.
SMS-01-002 Possible Filter-Bypass via unsafe URL check (Medium)
The app uses a WebView method called shouldOverrideUrlLoading()7 to determine
whether a URL should be loaded or blocked. This method is implemented in a vulnerable
way because it checks the URL string for certain values and makes use of the string-
method contains().8 This means that any URL, even if blacklisted, can be requested,
as long as the string ssweb