Penetration Test Report (iSEC): 150922 iSEC Security First Umbrella Final 2015 06 26 v1.1

Security First Umbrella
Source Code Review
Prepared for:
Prepared by:
Damian Profancik — Security Engineer
iSECPartnersFinalReport—SecurityFirstUmbrella Page2of22
©2015,iSECPartners,Inc.
Prepared by iSEC Partners, Inc. for Security First. Portions of this document and the templates used in its
productionarethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
June26,2015 SecurityFirstConfidential Version1.1
iSECPartnersFinalReport—SecurityFirstUmbrella Page3of22
Table of Contents
1 ExecutiveSummary ........................................................ 4
1.1 iSECRiskSummary ........................................................... 5
1.2 ProjectSummary ............................................................. 6
1.3 FindingsSummary............................................................ 6
1.4 RecommendationsSummary................................................... 6
2 EngagementStructure ..................................................... 8
2.1 InternalandExternalTeams ................................................... 8
2.2 ProjectGoalsandScope ....................................................... 9
3 DetailedFindings .......................................................... 10
3.1 Classifications................................................................ 10
3.2 Vulnerabilities ............................................................... 12
3.3 DetailedVulnerabilityList ..................................................... 13
June26,2015 SecurityFirstConfidential Version1.1
iSECPartnersFinalReport—SecurityFirstUmbrella Page4of22
1 Executive Summary
ApplicationSummary
ApplicationName Umbrella
ApplicationVersion 1.0
ApplicationType AndroidMobileApplication
Platform Android/Java
EngagementSummary
Dates June15,2015– June26,2015
ConsultantsEngaged 1
TotalEngagementEffort 2personweeks
EngagementType SourceCodeReview
TestingMethodology WhiteBox
VulnerabilitySummary
TotalHighseverityissues 0
TotalMediumseverityissues 0
TotalLowseverityissues 3
TotalInformationalseverityissues 7
Totalvulnerabilitiesidentified: 10
Seesection3.1onpage10fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 1 (cid:4)
AuditingandLogging 0
Authentication 0
Configuration 2 (cid:4)(cid:4)
Cryptography 2 (cid:4)(cid:4)
DataExposure 1 (cid:4)
DataValidation 2 (cid:4)(cid:4)
DenialofService 0
ErrorReporting 1 (cid:4)
Patching 0
SessionManagement 1 (cid:4)
Timing 0
June26,2015 SecurityFirstConfidential Version1.1
iSECPartnersFinalReport—SecurityFirstUmbrella Page5of22
1.1 iSEC Risk Summary
TheiSECPartnersRiskSummarychartevaluatesvulnerabilitiesaccordingtorisk. Theimpactofthe
vulnerabilityincreasestowardsthebottomofthechart. Thesophisticationrequiredforanattacker
tofindandexploittheflawdecreasestowardstheleftofthechart. Thecloseravulnerabilityistothe
chartorigin,thegreatertherisk.
w
o
• Excessive session timeout
L • Weak TLS/SSL ciphers supported
k
s
i
R
h
g
iH
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
June26,2015 SecurityFirstConfidential Version1.1
iSECPartnersFinalReport—SecurityFirstUmbrella Page6of22
1.2 Project Summary
OpenTechnologyFund(OTF)engagediSECPartners(iSEC)toperformasourcecodeassistedwhite
box security assessment of Security First's Umbrella mobile application. One iSEC consultant per-
formed the engagement remotely over two weeks, from June 15th, 2015 to June 26th, 2015. Security
FirstprovidediSECaccesstothemobileapplicationandtheapplicationsourcecodeduringthistime.
iSEC'sprimaryfocusduringtheassessmentwasonthemobileapplication,butalsoincludedareviewof
thebackendAPItransportsecurity. Theassessmentcoveredmobileapplicationsecuritybestpractices
alongwithvulnerabilitiesthatcouldputUmbrellausersatrisk. iSECalsoreviewedtheattacksurface
availablepriortoauthenticationorauthorizationspecificallyforinjectionflawsandDenialofService
(DoS)potential,amongotherclassesofvulnerabilities.
TheSecurityFirstteamprovidedsupportandwasengagedthroughouttheproject.
1.3 Findings Summary
Duetotheapplication'smostlyread-onlynature, theissuesidentifiedinthisreportonlyminimally
impact the security posture of both the application, and the mobile device on which it is installed.
WhileSQLInjectionandCross-SiteScriptingvulnerabilitiesarebothpresentintheapplication,they
are only able to be triggered locally, and exploitation does not achieve anything significant because
virtuallynouser-privatedataisstoredintheapplication,noristhereanynotionofan`account'foran
attackertocompromise.
Although the reported issues present a fairly low risk at this time, iSEC did highlight a number of
areas,(particularlyaroundverboseerrormessages,SQLInjection,CrossSiteScripting,andhardcoded
encryption keys issues), in which Security First could make improvements to its security posture.
Additionally,iSECmadeanumberofgeneral``bestpractice''suggestionsthatSecurityFirstmaychoose
toincorporatetofurtherimprovesecuritypostureoftheirapplication,includingprovidingorrequiring
alockmechanismfortheapplication.
1.4 Recommendations Summary
TheUmbrellaapplicationshouldperformmorerigorousinputvalidation,tighteningofaccesscontrols,
andshoringuptheSSL/TLSconfigurationofthebackendAPIserver. Additionally,iSECrecommends
hardeningoftheapplicationattacksurfacewiththebelownotedbestpractices.
ShortTerm
Shorttermrecommendationsaremeanttoberelativelyeasyactionstoexecute,suchasconfiguration
changes or file deletions that resolve security vulnerabilities. These may also include more difficult
actionsthatshouldbetakenimmediatelytoresolvehigh-riskvulnerabilities.Thisareaisasummaryof
shorttermrecommendations;additionalrecommendationscanbefoundinthevulnerabilitiessection.
June26,2015 SecurityFirstConfidential Version1.1
iSECPartnersFinalReport—SecurityFirstUmbrella Page7of22
SwitchtousingparameterizedSQLstatements. Althoughascurrentlydesigned,theapplicationis
notrealisticallyvulnerabletoSQLInjection,ifthedesignoftheapplicationischangedinthefuture,
thiscouldenableanattackerremoteSQLInjectionthroughmalformedIntents,orbypasslocaltrust
boundaries. Bestpracticeistouseparameterizedqueriesasastandarddevelopmentpractice.
Break out operationally sensitive secrets into configuration files. Depending on the secrets
involved and nature of the application, the configuration files may be managed separately from the
sourcecode,toallowsomedegreeofoperationalseparationofthesecretsfromotherteammembers
orthepublic.
Disable debug logging in production releases. Debug information discloses sensitive internal
informationabouttheapplication. Donotdirectlylogexceptionstacktraces,especiallyinproduction
releases.
LongTerm
Longtermrecommendationsaremorecomplexandsystematicchangesthatshouldbetakentosecure
the system. These may include significant changes to the architecture or code and may therefore
require in-depth planning, complex testing, significant development time, or changes to the user
experiencethatrequireretraining.
Considerproxyingdataretrievedfromthirdparties. Whennewsisretrievedfromthirdparties
thatmayhaveweakornonexistentTLSdeployment,theuser'sactivityleakstothenetworkandmaybe
modifiedintransit(oroutrightblocked). Considerproxyingthisdatathroughtheapi.secfirst.org
domain. Whileaccesstothisdomaincouldalsobeblocked,retrievingthisdataontheservershould
allowamoretrustworthyconnectionthanauser'spotentiallyhostilemobileorwirelessnetwork. It
alsoallowsUmbrellatopintheTLScertificatetoapi.secfirst.org.
Enable session timeouts based on user inactivity. Set a reasonable expiration time limit with
shorterwindowsavailabletobechosenbyuserswithanincreasedriskprofile.Thiswillreducethetime
anattackerwillbeabletoretainaccesstotheapplicationshouldthedevicebecomecompromised.
PerformregularchecksusingaTLSte