Penetration Test Report (Sixgen): Trinity Sixgen Assessment

1
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Table of Contents
Table of Contents 2
Assessment Information 4
Engagement Overview 5
Service Description 5
Engagement Objectives 5
Process and Methodology 6
Scoping and Rules of Engagement 7
Executive summary 8
Trinity Wallet Risk Rating 8
Overall Risk Rating: Low 8
Summary of Strengths 9
Summary of Weaknesses 9
Assessment Narrative 9
Local Data Storage 10
Network Communication 10
Authentication and Authorization 11
Interaction with the Operating System and Electron Security 12
Environmental Resilience and Code Integrity 13
Cryptography 16
User Interface Security 17
Repackaging Attacks 17
Vulnerability Overview 19
Vulnerability Findings and Recommendations 20
L1 - 2FA Enforced After Vault Decryption 20
L2 - Sandboxing and Context Isolation not enabled in Web Preferences 21
I1 - ASAR integrity is not verified on Windows 22
I2 - Linux AppImage does not include embedded GPG signature 23
I3 - iOS application allows screenshots 24
I4 - randomBytes called without max value compares against NaN 25
I5 - Checksums, GPG signature, and GPG key not easily available with binary downloads 26
2
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Assessment Information
​
About SIXGEN
​
SIXGEN conducted a security assessment of the desktop and
● SIXGEN cyber red teams provide
mobile Trinity Wallet for the IOTA foundation from
real-world attack emulation designed to
02/18/19 to 03/15/19. The purpose of this testing was to
assess and improve the effectiveness of an
entire information security program. evaluate and test risk associated with the Trinity wallet by
emulating a real-world attacker.
● Our goal is for an organization to
understand and limit cybersecurity risk to
Client Contact:
organizational operations, assets, and
individuals. Mathew Yarger
Technical Lead and Security Specialist
● Team members include veterans from the
Social Impact and Regulatory Affairs Team
world’s premier military and cybersecurity
The IOTA Foundation
organizations.
[PII_REDACTED]
mathew.yarger@iota.org
Lead Assessor:
Erik Hunstad
Adversary Emulation Lead
SIXGEN, Inc.
844 West St. | Ste 200
Annapolis, MD 21401
VETERAN-OWNED SMALL BUSINESS (VOSB)[PII_REDACTED]
CAGE: 677F0
erik@sixgen.io
DUNS: 079336791
TOP-SECRET Facilities Clearance
SIXGEN, Inc.
844 West St. | Ste 200
Annapolis, MD 21401
www.SIXGEN.io
3
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Engagement Overview
SIXGEN conducts penetration tests, adversary emulation, and external exposure assessments. At
SIXGEN, we specialize in manual assessments that go beyond basic automated tests to identify real
attack vectors that can be used against your application or environment.
With decades of combined offensive experience, SIXGEN is at the forefront of application security,
cloud security, and penetration testing. With a veteran team of subject matter experts, we staff
experts that are authorities in their field.
Service Description
This security assessment focused on emulating real-world attacks using the same techniques as
malicious actors. The Trinity wallet security assessment focused on the most likely and most
dangerous attacks as well as a code review to identify any architectural weaknesses in the wallet.
Engagement Objectives
SIXGEN’s consultants used the results of automated scanning tools, paired with their expert
knowledge and experience to conduct a manual security analysis of the Trinity wallet. Our assessors
attempted to exploit and gain unauthorized access to data through misconfigurations and exploits.
The detailed results of the vulnerability scanning, manual testing, and code review are shown in this
report.
4
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Process and Methodology
SIXGEN used a comprehensive methodology to provide a security review of the Trinity wallet on all
three major operating system (Windows, macOS, and Linux) as well as the mobile Trinity wallet on
both iOS and Android. This process begins with detailed scanning and research into the architecture
and environment, with automated testing for known vulnerabilities. Manual reconnaissance and
tailored exploitation of weaknesses followed.
1. Reconnaissance
The primary goal in this phase is to discover how the Trinity wallet processes and stores
sensitive data (e.g. the user’s seed) and how Trinity interacts with the operating system and
network. This information provides the foundation for a tailored security assessment.
Reconnaissance is carried out via automated scanners, dynamic analysis, and manual code
review.
2. Exploration and Verification
SIXGEN consultants use the results of the reconnaissance phase, paired with their expert
knowledge and experience to conduct a manual security analysis of the Trinity wallet. The
detailed results of this manual testing are shown in the tables in this report.
3. Assessment Reporting
Throughout the engagement, SIXGEN delivered detailed analysis and threat reporting to the
developers at the IOTA Foundation, including remediation steps. Our consultants set and
industry standard for clear and concise reports, prioritizing the highest risk vulnerabilities
first.
4. Remediation Assessment
SIXGEN provided remediation retesting for all vulnerabilities reported as they were
addressed. At the conclusion of the remediation testing the risk level determination for this
report was made and all issues in this report were remediated or were being tracked for
remediation.
5
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Scoping and Rules of Engagement
While malicious actors have no limits on their actions, SIXGEN understands the need to scope
assessments to complete the assessment in a timely manner and protect third parties not
participating in the engagement. The following limitations were placed upon this engagement, as
​​
agreed upon by the IOTA Foundation:
● The Trinity wallet on Windows, macOS, Linux, iOS, and Android was in scope
● Network communications made by the Trinity wallet were in scope (e.g. tampered IRI
responses)
● The IOTA network (e.g. iota.org and IRI nodes) was out of scope
● The IOTA ledger (“tangle”) and IOTA token were out of scope
6
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Executive summary
SIXGEN conducted a security assessment of the Trinity wallet for the IOTA Foundation. This test was
performed to assess the defensive posture of the Trinity wallet and provide security assistance
through proactively identifying vulnerabilities, validating their severity, and providing remediation
steps to IOTA Foundation developers.
SIXGEN reviewed the security of the Trinity wallet and has determined a low risk of compromise
from external attackers, as shown by the vulnerabilities detailed in this report. The detailed findings
and remediation recommendations for these vulnerabilities may be found later in this report.
Trinity Wallet Risk Rating
SIXGEN calculates the risk to the Trinity wallet based on exploitation likelihood (ease of exploitation)
and potential impact (potential business impact to the environment).
Overall Risk Rating: __ Low
​ ​
Exploitation
Likelihood
KEY
__ Informational
​
__ Low
​
__ Moderate
​
__ High
​
__ Critical
​
Potential Impact
7
SIXGEN, Inc. | IOTA Foundation Trinity Wallet Security Assessment
Summary of Strengths
While SIXGEN was tasked with finding issues and vulnerabilities in the Trinity wallet, it is useful to
know when positive findings appear. Understanding the strengths of the Trinity wallet can reinforce
security best practices and provide strategy and direction toward a robust defensive posture. The
following traits were identified as strengths in the Trinity wallet:
1. Trinity utilizes modern cryptography (e.g. Argon2i, AES-GCM) which protects secrets from
brute force attacks.
2. Trinity is memory conscious, and clears secrets from memory when they are not needed to
perform operations.
3. Trinity implemen