Penetration Test Report (Cure53): pentest report mullvad 2020 v2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report Mullvad Apps, Clients & API 05.2020
Cure53, Dr.-Ing. M. Heiderich, J. Larsson, MSc. R. Peraglie, MSc. F. Fäßler,
MSc. S. Moritz, BSc. C. Kean
Index
Introduction
Scope
Test Coverage
Coverage for Android Application
Coverage for iOS Application
Coverage for Windows Client
Coverage for Ubuntu Client
Coverage for macOS Client
Identified Vulnerabilities
MUL-02-002 WP2: Firewall allows deanonymization by eavesdropper (Medium)
MUL-02-006 WP1: Blind HTML Injection via Problem Report (Low)
MUL-02-007 WP2: Named Pipe exposed via SMB accessible for everyone (Medium)
Miscellaneous Issues
MUL-02-001 iOS: Lack of filesystem protections (Info)
MUL-02-003 WP1: General hardening recommendations for Android app (Info)
MUL-02-004 WP2: Firewall allows TCP connections to WireGuard gateway (Low)
MUL-02-005 WP1: VpnService logs static internal IPs to Android’s syslog (Info)
Conclusions
Cure53, Berlin · 06/12/20 1/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Introduction
“Have you ever thought about how online ads tend to follow you from site to site? Or
how Facebook knows exactly which ones to show you? We can assure you it's not
magic. Think about all the intimate questions and concerns you ask Google on a daily
basis. Or all of your personal shopping habits and interests that you feed to Amazon.
Not to mention that Alexa is constantly listening to everything you say. While you may
be doing this all from the privacy of your own home, your online life is, in contrast, very
public.”
From https://mullvad.net/en/what-is-privacy/
This report describes the results of a thorough security assessment of the Mullvad
complex. Carried out by Cure53 in May and June 2020, the project entailed both a
penetration test and source code audits, specifically targeting selected Mullvad
applications, clients and related API endpoints.
It needs to be underlined that the work was carefully scoped to cover only the client-side
parts within the Mullvad scope items, concurrently indicating that nothing on a server-
side received significant attention unless it has direct bearing on the apps. It is
envisioned that a dedicated assessment focused on the server-side will ensue. Further
of note is the fact that the project continues the cooperation between Cure53 and
Mullvad initiated back in 2018. In particular, the Cure53 team examined similar scope for
Mullvad in September 2018, with a report from this project headlined MUL-01.
Based on the previous experience and the discussion with the Mullvad team, Cure53
demarcated two work packages. In WP1, tests and audits of the Mullvad mobile
applications for both Android and iOS were carried out. Similar approaches of security
testing and auditing were deployed also in WP2 which nevertheless centered on the
Mullvad VPN applications across three branches, namely Windows, Ubuntu and macOS.
The methods used during the assessment entail a white-box approach, dictated by the
simple fact that all Mullvad software in scope is available as open source on GitHub.
Cure53 had access not only to the sources but also to dedicated builds and threat
modeling information. Further made available were test-users via a range of voucher
codes that the Cure53 team could use and create new users. These are listed in the
Scope chapter. Finally, the testers received a detailed briefing about the expectations
set for this penetration test and audit from Mullvad's perspective.
The project started on time and progressed efficiently. In terms of timeline, resources
and communications, it should be noted that six members of the Cure53 team were
tasked with this project and given a budget of twenty days to reach the expected level of
Cure53, Berlin · 06/12/20 2/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
coverage. All work was completed in late May and early June of 2020, with
communications between Cure53 and Mullvad executed in a dedicated, private Slack
channel created by Cure53 and then joined by relevant Mullvad personnel. Slack could
be used for asking questions, as well as let the Cure53 team deliver status updates and
data about the emerging and confirmed findings. All discussions were helpful, facilitating
good flow of the project.
Moving on to findings, it can be noted that only seven items have been spotted and
documented. Two problems represent security vulnerabilities while five have been
classified as general weaknesses with lower or even non-existent exploitation potential.
This is a good result for Mullvad, especially in the light of this project containing very
thorough reviews and several deep-dive attempts at compromising the software in
scope. Back in September 2018, the same number of seven issues was spotted, yet
they included both Critical- and High-scoring bugs. This pattern has not recurred here as
none of the findings stemming from this 2020 project exceeded a severity rank of
Medium. All findings were live-reported to the Mullvad team via PGP-encrypted emails.
Some fixes have been verified while the test was still ongoing.
In the following sections, the report will first shed light on the scope and key test
parameters. After that, a dedicated chapter on the test coverage and methodology will
furnish insights into what the Cure53 team looked at, even if a given approach yielded
no results. Next, all findings will be discussed in a chronological order alongside
technical descriptions, as well as PoC and mitigation advice when applicable. Finally, the
report will close with broader conclusions about this 2020 penetration testing and
auditing of the Mullvad scope. Cure53 elaborates on the general impressions and
reiterates the verdict based on the testing team’s observations and collected evidence.
Tailored hardening recommendations for Mullvad are also incorporated into the final
section.
Cure53, Berlin · 06/12/20 3/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Source code audits & security assessments against Mullvad apps, clients & API
◦ WP1: Security tests & code audits against Mullvad mobile apps for Android & iOS
▪ Mullvad Android version in scope:
• 2020.5-beta1
• https://github.com/mullvad/mullvadvpn-app/releases/tag/2020.5-beta1
▪ Mullvad iOS version in scope:
• 2020.3 build 2
▪ Git commit hash:
• 1e4bc2dba4517c8b14cc40b40f679eb44a783a60
◦ WP2: Security tests & code audits against Mullvad desktop apps for Windows,
Ubuntu, macOS
▪ Mullvad Windows, Linux and macOS version in scope:
• 2020.4
• https://github.com/mullvad/mullvadvpn-app/releases/tag/2020.4
◦ Sources were shared with Cure53 via GitHub (OSS)
◦ Binaries were shared with Cure53 as well
Cure53, Berlin · 06/12/20 4/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Test Coverage
This section describes the testing methodology and coverage. In terms of methods, an
emphasis has been placed on what has been done in order to evaluate the current
security posture of the Mullvad’s applications, which as of this assessment offers client
applications for Android, iOS, Windows, Ubuntu and macOS.
In order to provide a structured overview, the assessment has been divided into five
sections: Android Application, iOS Application, Windows Client, Ubuntu Client and
macOS Client. This assessment has been carried out with a white-box methodology and
this has bearing on what type of actions and steps undertaken during this assessment.
Coverage for Android Application
A list of items below details noteworthy tasks undertaken during the Android application
phase of this audit. This is to underline what the Cure53 testers covered during their
analysis, especially in regards to items related to the Android application, further
shedding light on the coverage and methodology applied during this phase