Penetration Test Report (Cure53): pentest report smartsheriff 2

Pentest-Report SmartSheriff 10.2015
Cure53, Dr.-Ing. Mario Heiderich, Fabian Fäßler, Dipl.-Ing. Abraham Aranguren
Index
Introduction
Scope
Identified Vulnerabilities
SMS -02-002 Complete lack o f authentication on mos t AP I calls ( Critica l)
SMS -02-003 Smar t Sherif f AP I stil l allows universa l Password Leak ( Critica l)
SMS -02-004 Smar t Sherif f leaks paren t phone numbers ( Medium )
SMS -02-005 Insufficien t cryptographic XOR Protection for sensitive Data ( High )
SMS -02-006 Reflected XSS via H _ TYPE on ssweb . moiba . or . kr ( Medium )
SMS -02-007 Possible Remote Code Execution via MitM in WebView ( Critica l)
SMS -02-008 Mobile app error handlers are setup to ignore al l SSL errors ( High )
SMS -02-009 Modifying Child - App Protection Settings ( Medium )
SMS -02-010 Faking Child ’ s Phone Usage ( High )
SMS -02-012 Insecure usage o f AES Encryption ( Critica l)
SMS -02-013 Unsafe Mobile App Data Storage on SD Card ( High )
Miscellaneous Issues
SMS -02-011 Multiple TLS Misconfiguration issues ( Info )
SMS -02-001 Multiple Instances o f outdated Software on AP I Servers ( Medium )
Conclusion
Introduction
“The Smart Sheriff versions analyzed by the researchers stored and transmitted user
data insecurely, and did not properly implement industry-standard encryption. This
insecurity makes it possible for attackers to monitor data, and impersonate both servers
and apps to tamper with data. The researchers also found that Smart Sheriff sends
browsing data back to MOIBA servers, despite this functionality purportedly being
disabled in May 2015 over privacy concerns.”
From https :/ / citizenlab . or .. . r t - sherif f - south - korea /
1/19
This report describes a follow-up analysis against the Smart Sheriff mobile apps, which
is a government-mandated smartphone application compound deployed in South Korea.
The project states its purpose as allowing parents1 to monitor the online activities of their
children2. The analysis against the version(s) 1.7.7 was carried out by two senior-testers
of the Cure53 team and took a total of four days to complete. The findings are based on
a penetration test (and its results) against an older version of the same application
conducted back in July 2015.
In terms of the process and timeline, the results of the first test were made public back in
September 2015 and were published together with a detailed report3 from Citizen Lab,
Toronto. The report exposed critical security vulnerabilities in Smart Sheriff4. Later on
MOIBA5, the maintainer of the vulnerable applications, claimed that all critical
vulnerabilities have been fixed and consequently released several new versions of the
application compound6. However, as this report demonstrates, the second round of
testing revealed many problems and outright flaws with regard to reliability and
robustness of the MOBIA’s fixes that were advertised as repaired and handled.
First and foremost it must be stated that as many as 12 of the 18 security flaws
previously identified by Cure53 have not been fixed at all. What is even more worrisome,
this pool of vulnerabilities includes a very high proportion of 8 issues with either a
“Critical” or a “High” ranking. The second and equally dismal discovery is the behavior of
the maintainer falsely claiming that the problems have been resolved and thus
misleading the users and putting them at risk. This exposure, especially paired with the
fact that the results of the first round of testing are now public, leaves the users fully
open to attackers taking control of their phones, intercepting their communications, as
well as gaining access to all of their account data, associated and private information. In
addition, it is tremendously impactful and unacceptable that the attacker can now
remotely load applications of their choosing onto a child’s phone. All this combined
sheds light on the lack of responsibility and loyalty towards the users whose privacy and
security do not seem to be taken seriously by MOIBA. Finally, it has to be underscored
that a situation in which maintainers’ interests are protected while users’ safety is
ignored is a clear display of treacherousness on MOIBA’s part. With this report being
based on solid two-phase research and testing, the presented evidence cannot be
denied and can only be read as a recommendation to discontinue the Smart Sheriff
services.
1 https :// play . google . com / store / apps / details ? id = com . g t 101 . cleanwave & h l = en
2 https :// play . google . com / store / apps / details ? id = kr . or . moiba . smartsherif f . child & h l = en
3 https :// twitter . com / citizenlab / status /[PII_REDACTED]38345472
4 http :// bigstory . ap . org / article /947 a 7 b 2.. . ewsbreak - south - korea - backed - app - puts - children - risk
5 https :// www . moiba . or . kr /
6 https :// ss . moiba . or . kr / customer / bbs / lis t . do ? BBS _ BOARD _ CODE = Notice
2/19
Honing in on the specifics, the following list of issues has been taken from the previous
report7 and enumerates those problems that were indeed verified as fixed by MOIBA:
• SMS-01-002 Possible Filter-Bypass via unsafe URL check (Medium)
• SMS-01-003 No use of any SSL/TLS-based transport security (High)
• SMS-01-004 Smart Sheriff Test-Page leaks Data and App-Internals (Medium)
• SMS-01-008 Reflected XSS via CHILD_MOBILE on ssweb.moiba.or.kr (Medium)
• SMS-01-012 Unsafe Mobile App Data Storage on SD Card (High)
• SMS-01-015 API leaks Personal data of Users of the Child-App (High)
Furthermore, as already mentioned above, a plethora of more relevant and pressing
results of this investigation is much more concerning and can be found below. This
report outlines the the fixes that can be characterized as incomplete, introducing new
problems, or being prone to variations. To reiterate, the state of security for the Smart
Sheriff applications has not been significantly altered or improved. The newly installed
fixes were often deemed faulty and/or partial, creating a dangerous and false sense of
security. Regardless of what the maintainer claims, the level of insecurity found in the
Smart Sheriff application has not changed.
Scope
• SmartSheriff Parent App
◦ http :/ / apkpure . com /% EC %8 A % A 4% EB % A 7%88% ED %8 A % B 8% EB % B 3% B 4% EC
%95%88% EA % B 4%80-% EB % B 6%80% EB % AA % A 8% EC %9 A
% A 9 / com . g t 101 .cleanwave
• SmartSheriff Child App
◦ http :/ / apkpure . com /% EC %8 A % A 4% EB % A 7%88% ED %8 A % B 8% EB % B 3% B 4% EC
%95%88% EA % B 4%80-% EC %9 E %90% EB %85%80% EC %9 A % A 9- lite % EB
% B 2%84% EC % A 0%84 / kr . or . moiba . smartsherif f .child
7 https :// cure 53 . de / pentes t - repor t _ smartsherif f .pdf
3/19
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. SMS-02-001) for the purpose of facilitating any
future follow-up correspondence.
SMS-02-002 Complete lack of authentication on most API calls (Critical)
The Smart Sheriff generally does not require any cookie authentication (a session ID or
the like) or any form of authentication to perform a broad number of operations on behalf
of the user. To add to this, even the DEVICE_ID parameter can be left out in most API
calls which will continue to return results without a problem.
By now it is also not surprising that the MOBILE parameter has to only be XOR
encoded, explaining why the MOBILE parameter is “]5████████5]” on all API
requests below:
XOR IN XOR OUT
]5████████5] 0████████4
0████████4 ]5████████5]
Example 1: CLT_MBR_GETCLIENTMEMBERINFO: Child Data, Parent mobile leak,
etc. (The results shown below are both from the July and the October tests. They are
accordingly lab