Penetration Test Report (Atredis): Atredis+Partners+ +Mullvad+VPN+Platform+Security+Assessment+ +Report+v1.0

Mullvad
VPN Platform Security
Assessment
Security Assessment Report
Project Team:
Technical Testing Jordan Whitehead and William
Vu
Prepared for Mullvad VPN AB
October 14, 2022 (version 1.0) Technical Editing Nick Nam and Sara Bettes
Project Management Sara Bettes
Atredis Partners www.atredis.com
Atredis Partners ⚫ Bene Diagnoscitur, Bene Curatur
Atredis Partners – Mullvad VPN Platform Security Assessment
Table of Contents
Engagement Overview ............................................................................................... 3
Assessment Components and Objectives ................................................................. 3
Engagement Tasks ..................................................................................................... 4
Binary and Runtime Analysis ................................................................................. 4
Configuration and Architecture Review .................................................................... 4
Network Protocol Analysis ..................................................................................... 4
Source Code Analysis ........................................................................................... 5
Executive Summary ................................................................................................... 6
Key Conclusions .................................................................................................. 6
Architecture Analysis ................................................................................................. 7
Desktop Clients ................................................................................................... 7
Mobile Clients ..................................................................................................... 8
Findings Summary ..................................................................................................... 9
Remediation Tasks ............................................................................................ 10
Findings and Recommendations .............................................................................. 11
Findings Summary ............................................................................................. 11
Findings Detail .................................................................................................. 11
MUL22-01: Out-of-Bounds Read in win-split-tunnel (Windows) .................................. 12
MUL22-02: Leak of Traffic During System Shutdown ................................................ 15
MUL22-03: Connectivity Checks Bypass VPN (Android) ............................................ 17
MUL22-04: Permissive Inbound Network Filtering (Android) ...................................... 20
MUL22-05: Siri Shortcuts Susceptible to Manipulation (iOS) ...................................... 22
Appendix I: Assessment Methodology .................................................................... 25
Appendix II: Engagement Team Biographies .......................................................... 28
Appendix III: About Atredis Partners ..................................................................... 34
Atredis Partners Page 2
Atredis Partners – Mullvad VPN Platform Security Assessment
Engagement Overview
Assessment Components and Objectives
Mullvad VPN AB (“Mullvad”) recently engaged Atredis Partners (“Atredis”) to perform a
Security Assessment of the Mullvad VPN clients. Objectives included validation that the
Mullvad VPN clients were developed and deployed with security best practices in mind, and
to obtain third party validation that any significant vulnerabilities present in the Mullvad VPN
clients were identified for remediation.
Testing was performed from September 6 through October 6, 2022, by Jordan Whitehead and
William Vu of the Atredis Partners team, with Sara Bettes providing project management and
delivery oversight. For Atredis Partners’ assessment methodology, please see Appendix I of
this document, and for team biographies, please see Appendix II. Specific testing components
and testing tasks are included below.
COMPONENT ENGAGEMENT TASKS
Mullvad VPN Platform Security Assessment
Assessment Tasks
• Source-Assisted Runtime Assessment of Mullvad VPN clients
• Instrumented Security Review of Userland, Kernel
Drivers
• Automated and runtime application testing
• Analysis of privilege model of Mullvad components
• Test case creation, fuzzing and fault injection
• PoC generation and validation of findings
• Application API / web services penetration testing
• Application API automated and runtime testing
• Manual runtime analysis and protocol analysis
• Network attack chain review and traffic analysis
Reporting and Analysis
Analysis and Deliverables
• Status Reporting and Realtime Communication
• Comprehensive Engagement Deliverable
• Engagement Outbrief and Remediation Review
The ultimate goal of the assessment was to provide a clear picture of risks, vulnerabilities,
and exposures as they relate to accepted security best practices, such as those created by
the National Institute of Standards and Technology (NIST), Open Web Application Security
Project (OWASP), or the Center for Internet Security (CIS). Augmenting these, Atredis
Partners also draws on its extensive experience in secure development and in testing high-
criticality applications and advanced exploitation.
Atredis Partners Page 3
Atredis Partners – Mullvad VPN Platform Security Assessment
Engagement Tasks
Atredis Partners performed the following tasks, at a high level, for in-scope targets during the
engagement.
Binary and Runtime Analysis
For relevant software targets identified during the course of this engagement, Atredis
performed binary and runtime analysis, using debugging and instrumentation tools to analyze
application flow to aid in software security analysis. Where relevant, purpose-built tools such
as fuzzers and customized network clients may have been utilized to aid in vulnerability
identification.
Configuration and Architecture Review
Atredis Partners performed a high-level review of available documentation and configuration
data with an eye toward the overall functional design and soundness of the implementation.
A key aspect of this component was identifying gaps in the architecture and design regarding
aspects of design that reduce overall defensibility, aimed at pointing out fundamental issues
in the application architecture that should be addressed early in the development cycle as
opposed to later when the platform is closer to a full production state.
While specific vulnerabilities may be identified during the architecture and configuration
review, the intent is less on finding individual defects and more on how the design of a given
target affects its overall defensibility. Outcomes of the architecture review helped inform
testing objectives throughout the rest of the engagement while also helping the client define
a long-term platform maturity and security design roadmap.
Network Protocol Analysis
With the objective of identifying scenarios where the integrity of trusted communications can
be diminished or reduced, Atredis Partners reviewed network traffic using various packet flow
analysis and packet capture tools to observe in-scope network traffic. Network
communications were analyzed for the presence of cleartext communications or scenarios
where the integrity of cryptographic communications can be diminished, and Atredis
attempted to identify means to bypass or circumvent network authentication or replay
communications, as well as other case-dependent means to abuse the environment to disrupt,
intercept, or otherwise negatively affect in-scope targets and communications.
Atredis Partners Page 4
Atredis Partners – Mullvad VPN Platform Security Assessment
Source Code Analysis
Atredis reviewed the in-scope application source code, with an eye for security-relevant
software defects. To aid in vulnera