Penetration Test Report (NCCGroup): NCC Group Google GOOG169 Report 2022 04 07 v1.2

Google Enterprise API Security Assessment
Google
April 7, 2022 – Version 1.2
Preparedfor
EugeneLiderman
MikeBurr
Preparedby
SimonWatson
Executive Summary
Synopsis
During the autumn of 2021, Google engaged NCC Group to perform a review of the Android 12 Enterprise API to
evaluateitscompliancewiththeSecurityTechnicalImplementationGuides(STIG)matrixprovidedbyGoogle.
This assessment was also performed with reference to the Common Criteria Protection Profile for Mobile Device
Fundamentals(PPMDF),1fromwhichtheSTIGwasderived.
Due to the limited nature of the testing, certain elements of the STIG requirements are expected to be covered
separatelyeitherviaFIPS140-2orCommonCriteriaEvaluation.
Scope
NCCGroup’sevaluationincluded:
• Validation of Individual STIG Controls: all individual controls detailed as part of the STIG (approximately 120
controls) were, where possible, validated by NCC Group to ensure that appropriate protections were applied as
expected.
• ReviewofAttackSurfacewithSTIGapplied: withthesecuritycontrolsapplied,theremainingattacksurfacewas
reviewedagainstthethreatsidentifiedinthePPMDFtoattempttoidentifyanyweaknesses.
Thesethreatsincluded:
• NetworkEavesdrop-Anattackerispositionedonawirelesscommunicationchannelorelsewhereonthenetwork
infrastructure.
• Network Attack - An attacker is positioned on a wireless communication channel or elsewhere on the network
infrastructure.
• PhysicalAccess-Anattackerwithphysicalaccessmayattempttoaccessuserdataonthemobiledeviceincluding
credentials. (Note: intrusiveattacksrequiringdismantlingoftestdevicewerenotinscope)
• MaliciousApplication-Applicationsloadedontothemobiledevicemayincludemaliciousorexploitablecode.
• PersistentPresence-Persistentpresenceonadevicebyanattackerimpliesthatthedevicehaslostintegrityand
cannotregainit.
Testingwasperformedon:
• GooglePixel4A5Gdevice(SN:14241JECB068650)
• Android12Beta5(Build: SPB5.210812.002)
• Google’s‘AndroidatWork’demonstratorplatform
Limitations
Thistime-limitedassessmentfocusedexclusivelyonvalidatingthereductioninattacksurfaceachievedviacompliance
withtheSTIG-alongwithvalidatingthatthecontrolsappliedaspartoftheSTIGwereappropriatelyapplied. Itwas
notfocusedonidentifyinganyplatformvulnerabilitiesbeyondconfirmingtheintendedreductioninattacksurface.
SomecontrolscontainedwithintheSTIGwereunabletobetestedbyNCCGroupaspartofthisassessment,butare
expectedtobecoveredbyaseparateCommonCriteriaEvaluationreportthatGoogleintendstopublishalongsidethe
releaseofAndroid12. Thedetailsofthisseparatereportarenotdiscussedherein.
ThisevaluationonlyvalidatedthecontrolsasimplementedbyGoogle’sTestDPCapplication, anddidnotmakeany
judgment or assessment about third-party solutions that use these APIs and should themselves be independently
validated.
KeyFindings
WiththefullsetofSTIGrequirementsapplied,thethreatsspecifiedinthePPMDFwereeffectivelymitigated. Ofthe
individualSTIGrequirementsreviewed,noissueswereidentifiedthatimpactedCATISTIGrequirements. Thefindings
1https://commoncriteriaportal.org/files/ppfiles/pp_md_v3.1.pdf
2 | GoogleEnterpriseAPISecurityAssessment NCCGroup
belowpertaintoCATIIandCATIIIissues.
• TheCATIISTIGrequirementforpasswordcomplexitydidnotappeartobecorrectlyimplementedintheversionof
Android12thatwastested.Itwasexpected(accordingtotheSTIGcontrols)thattworepeatedorsequentialnumbers
wouldberejected,howeverthisrejectiononlyseemedtohappeniffournumberswererepeatedorsequential(see
NCC-GOOG169-001). This is considered as a legacy requirement which is updated in the newer STIG and is not
consideredariskduetootheranti-bruteforcemitigations.
• TheCATIIISTIGcontrolrequiresthattheMDMbeabletodisable(amongothers)Wi-Fifunctionalityonthedevice. It
wasfoundduringtestingthatevenwhendisabled,itwaspossibleforanauthenticatedusertoenabledWi-Fithrough
the‘QuickSettings’application.
3 | GoogleEnterpriseAPISecurityAssessment NCCGroup
Dashboard
TargetMetadata EngagementData
Name Android12 Method Black-box
Dates 2021-09-17to2021-10-04
Consultants 1
LevelofEffort 10person-days
Targets
GooglePixel4A5G
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 0
Lowissues 2
Informationalissues 3
Totalissues 5
CategoryBreakdown
AccessControls 1
Authentication 1
Other 3
Key
Critical High Medium Low Informational
4 | GoogleEnterpriseAPISecurityAssessment NCCGroup
Table of Findings
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application’s
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors. ForanexplanationofNCCGroup’s
riskratingandfindingcategorization,seeAppendixAonpage13.
Title Status ID Risk
PasswordsPermittedContainingThreeRepeatingorSequentialCharacters Fixed 001 Low
Wi-FiRemainsConfigurableviaQuickSettings Fixed 005 Low
UserCanDisableAuthenticationofPersonalHotspotConnections Reported 002 Informational
FingerprintAuthenticationStillUsableforPurchasesandApplicationAuthen- Reported 003 Informational
tication
BluetoothQuickToggleFunctionalWhenBluetoothDisabledByMDM Reported 004 Informational
5 | GoogleEnterpriseAPISecurityAssessment NCCGroup
Finding Details
Finding PasswordsPermittedContainingThreeRepeatingorSequentialCharacters
Risk Low Impact: Low,Exploitability: None
Identifier NCC-GOOG169-001
Status Fixed
Category Authentication
Impact AusercansetalesscomplexPIN/PasswordthanthatmandatedbytheSTIG.
Description STIGIDGOOG-12-006100states:
“Google Android 12 must be configured to not allow passwords that include more than two
repeatingorsequentialcharacters.”
Thefollowingprescribedprocedurewasfollowed:
1. Open“Lockscreen”settings.
2. Open“Passwordconstraints”.
3. Setpasswordqualityto“Numeric(Complex)”.
Afterward,NCCGroupnotedthatthefollowingPINswereacceptedbythedevice:
• 333666
• 123321
Thisappearstofalloutsideofthespecifiedboundary.
Recommendation Validate whether there is an issue with the Test DPC application configuring the restriction
correctly,orwhetherthisisabug.
ClientResponse Arevisedprocedurewassuggested:
1. Open“Lockscreen”settings.
2. Open“Passwordconstraints”.
3. Setpasswordqualityto“Numeric(Complex)”.
4. Setpasswordlengthto6.
5. Tap“RequestUsertosetanewpassword”. thentrytoseeifyoucanuserepeat-
ingnumbersorcharacterswhensettingthenewpassword.
HoweveritwasstillpossibletosettherepeatingandsequentialPINs.
10/06/2021:GoogleconfirmedthattherepeatingnumberlogininAndroid12isonlyhitatthe
4thdigit. AmitigationisbeingaddedtotheSTIGstating:“DoesnotMeet,canbemitigatedby
increasingthepasscodelengthfrom6to8digitsandselectingMediumorHighcomplexity.”
31/03/22:GoogleobservedthatthisisalegacyrequirementthatDISAischanginginthenext
STIGrevisionduetothefactthatsmartphoneshavestronganti-bruteforcemeasuressuchas
throttlingandtriggeringafactoryresetofthedevice. Asanexample,theSamsungAndroid
12 STIG already incorporates this change. Consequently NCC Group no longer considered
thisanissue.
STIGID GOOG-12-006100
6 | GoogleEnterpriseAPISecurityAssessment NCCGroup
Finding Wi-FiRemainsConfigurableviaQuickSettings
Risk Low Impact: Medium,Exploitability: Medium
Identifier NCC-GOOG169-005
Status Fixed
Category Other
Impact An attacker, or an indifferent or unaware user could configure the device to connect to an
insecureWi-Finetwork,whichcouldfacilitate(forexample),man-in-the-middleattacks.
Description IntheTestDPCapplication,thereisaconfigurationoptionto“DisallowconfigWi-Fi”,withthe
expectationthatthisensurestheend-usercannotconfiguretheWi-Fisettingsonthedevice.
AlthoughaccessingWi-FiviaSettings -> Network and Internet -> Internetresulted
intheexpectederror:
Figure1: Expecteddeniedmessage
7 | GoogleEnterpriseAPISecurityAssessment NCCGroup
It was observed however that Wi-Fi could still be configured by the extended quick menu
panel:
Figure2: Wi-Fiquickmenu
Fromthisscreen,itwaspossibletoenableanddisableWi-Fi,andconnecttonewnetworks.
TheSTIGstatesthat“GoogleAndroid12mustprovidethecapabilityfortheAdministrator(EMM)
toperformthefollowingmanagementfunction:enable/disablethecellularradio,Wi-Firadio,and
Bluetoothradio(iftheradioissupportedbythemobiledevice)”.
Thi