Penetration Test Report (Cure53): pentest report cyph

Pentest-Report Cyph 05.-06.2015
Cure53, Dr.-Ing. M. Heiderich, J. Horn, Dr. J. Magazinius, F. Fäßler, A. Inführ
Index
Introduction
Scope
Identified Vulnerabilities
CY -01-002 Fake - Channels cause Memcache Eviction and possible DoS ( Medium )
CY -01-003 Castle: WebRTC connections lack Security Properties ( Medium )
CY -01-005 Castle: Nonce Reuse in initia l Handshake Messages ( Medium )
CY -01-006 Castle: Server could MitM connections using hardware for ~$20 k ( High )
CY -01-007 Message ordering is no t protected allowing message drop ( Medium )
CY -01-008 Coturn : My S QL on Por t 3306 with defaul t Credentials ( Critica l)
CY -01-009 Coturn : S erver Admin Interface is using Defaul t Credentials ( Medium )
CY -01-010 Coturn : SQL Injection in S erver Admin Interface Login Page ( Critica l)
CY -01-011 WebSign: TLS - MitM - Attacker can replace Cyph code ( High )
Miscellaneous Issues
CY -01-001 Padding is useless for the stated purpose ( Info )
CY -01-004 Uneven distribution o f characters in random IDs in links ( Low )
CY -01-012 Missing noreferrer Attributes allow Access to window . opener ( Low )
CY -01-013 Markdown Converter for Messages uses Schema Black - Lis t ( Low )
Conclusion
1/17
Introduction
“Cyph is a revolutionary new secure messenger, created to defend the world from mass
surveillance. Cyph lets you talk in absolute confidence. Carefully designed using high-
end cryptography, Cyph protects your conversations against anything from nosy
neighbors to agencies armed with theoretical quantum attacks. Yet, Cyph remains
simple for anybody to use, and works on every device in one click — no installation or
registration required.”
From https :// www . cyph . com /
This penetration test and source code audit against the Cyph codebase and
infrastructure was carried out by five testers of the Cure53 team. It took twelve days total
to complete and yielded an overall of nine security vulnerabilities, as well as four general
weaknesses. Several of the identified issues were classified to be of critical severity. This
is due to the fact an attacker could misuse these areas to compromise a server which is
of key importance for some features of the project. This means a capability to hinder
operational and functional value of the entire tool. It needs to be noted, however, that
three of the security vulnerabilities mentioned in this report (and that includes all of the
so called “criticals”) were resulting from the usage of an insecure third-party software,
namely the TURN server project “Coturn”.1
The tests covered various aspects of application- and server-security, investigated
cryptographic implementations, and addressed browser security encompassing web
crypto, service workers and the Cyph-specific usage of the location.hash property.
Several of the libraries employed by Cyph were also analyzed. In addition to the full set
of source code availability, the testers had access to a live version of the application and
a dedicated VM that was created during the test for debugging purposes.
The issues spotted in third-party tools were reported to the maintainer of the Coturn
project and fixed within a few days.2 New versions of both Coturn and the RFC 5766
reference implementation3 was released. Similar releases occurred for versions of
Amazon AWS images, while the old and vulnerable ones have been removed. It is
recommended to anyone using Coturn to to use the deployed images instead and
update to the most recent version.
All issues spotted in the actual Cyph implementation and its accompanying library
WebSign - have been reported to the project maintainers and fixed promptly and quickly.
All fixes have been reviewed and verified as working by the Cure53 team.
1 https :// code . google . com / p / coturn /
2 https :// code . google . com / p / coturn / wik i /Downloads
3 https :// code . google . com / p / rfc 5766- turn - server /
2/17
Scope
• Cyph.im Website
◦ https :/ / www . cyph . im /
• Sources on GitHub
◦ https :/ / github . com / cyph /cyph
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
(e.g. CY-01-00X) for the purpose of facilitating any future follow-up correspondence.
CY-01-002 Fake-Channels cause Memcache Eviction and possible DoS (Medium)
The API (default/api.go) is used to register and connect to a channel. The Cyph ID and
the channel description are stored in the memcache of the application engine. Even
though the length of the Cyph ID has to amount to 7 characters, the channel description
has no such restriction. Importantly, a memcache entry can only be up to 1MB. A
channel description expires after 48 hours. Depending on whether Cyph is running on
either a shared or a dedicated memcache, the issue can have differing implications.
When a channel is created its description is stored in the memcache. Importantly, this
value can only be accessed once from the person who wants to connect to this channel.
If the channel key is evicted from memcache due to the memcache being full in the
meantime, however, then the other person can no longer connect to this channel. This is
a race against time, but with 1MB of fake channel descriptions, this might be very easy
to achieve. Obviously, the factors of the maximum memcache size and a determination
of whether it is running on a shared or a dedicated memcache must be taken into
account.
If Cyph is running on a dedicated memcache, 1GB of data costs $0.06 per hour.4 This
means expiration time of 48 hours. Analogically, 1GB of fake channels costs $2.88 and
circa 35GB of memcache data totals to roughly $100 over 48 hours. This can be
achieved with only 35.000 requests. The default maximum for dedicated memcache is
100GB, which would cost $288 over 48h with only 100.000 requests.
4 https :// cloud . google . com / appengine / docs / adminconsole /memcache
3/17
Simplified PoC:
import requests, random
def post(data):
r = random.randint(1111111,9999999)
url = "https://api.cyph.com/channels/"+str(r)
requests.post(url, data=data)
while True:
post({"channelDescriptor":"A"*(1048500)})
A similar financial issue exists for the Google App Engine data storage5 used with beta
sign-ups. To mitigate this issue the maximum size of the channel description should be
limited to a few hundred bytes. This would hinder the feasibility of a cache eviction
attack.
Note: A fix has been created by the Cyph team and it was verified as working and valid
by Cure53.
CY-01-003 Castle: WebRTC connections lack Security Properties (Medium)
The document describing the Castle messaging protocol claims the following:
Note that voice/video is equally quantum-safe, as WebRTC’s DTLS key
exchange is encrypted by Castle
However, the messages Castle encrypts merely contain the fingerprints of public keys
used in the DTLS connection. The browser then does a TLS handshake directly over the
network, having been authenticated with the use of the exchanged fingerprints. For
Google Chrome’s users the public keys that are authenticated through the fingerprints
are 1024-bit RSA keys.6
Between modern browsers, an ECDHE cipher-suite7 is then negotiated, and therefore
breaking the 1024-bit RSA key once the handshake has been completed does not allow
an attacker to decrypt the exchanged data. At the same time, an attacker with the ability
to break ECDH would be able to decrypt the data. Because ECDH is not secure against
quantum computing attacks, a future attacker with access to a quantum computer would
be able to break the DTLS layer, consequently gaining a chance to decrypt voice and
video data.
Note: A fix has been created by the Cyph team and it was verified as working and valid
by Cure53.
5 https :// cloud . goo