Penetration Test Report (7ASecurity): pentest report psiphon e

Test Target:
Psiphon Enhancements
Pentest Report
Client: Psiphon Inc.
7ASecurity Test Team:
● Abraham Aranguren, MSc
● Miroslav Stampar, MSc
● Patrick Ventuzelo, MSc
7ASecurity LLLP
Protect Your Site & Apps From Attackers
sales@7asecurity.com
Pentest Report
INDEX
Introduction 3
Identified Vulnerabilities 5
PSI-01-005 E2: Possible Client DoS via Traffic Tampering (Low) 5
Miscellaneous issues 8
PSI-01-001 E2: Possible DoS via slice bounds out-of-range Weaknesses (Low) 8
PSI-01-002 E4: Possible DoS via nil pointer dereference (Info) 13
PSI-01-003 E4: Possible DoS via interface conversion panic (Info) 15
PSI-01-004 OOS: Windows Client DoS via known Temporary File Creation (Low) 16
Conclusion 19
7ASecurity LLLP © 2020
2
Pentest Report
Introduction
“Psiphon is a circumvention tool from Psiphon Inc. that utilizes VPN, SSH and HTTP
Proxy technology to provide you with uncensored access to Internet content. Your
Psiphon client will automatically learn about new access points to maximize your
chances of bypassing censorship.”
Fromhttps://www.psiphon3.com/en/index.html
This report documents the results of a security audit and best-practices review
conducted by 7ASecurity, focusing on a number of Psiphon circumvention
enhancements, including the code and components surrounding such features.
Given the nature of Psiphon, the 7ASecurity team performed this assignment assuming
the role of government-sponsored adversaries with Man-in-the-middle (MitM)
capabilities, aiming to defeat the censorship eluding features of Psiphon. Due to the
public status of this report, the team will use less descriptive terms like enhancement1,
enhancement2, enhancement3 and enhancement4 as well as tactic1 and tactic2, etc. to
prevent potential adversaries from gaining insight about Psiphon internals.
Psiphon requested 7ASecurity to perform a secure code audit on the following four
recent circumvention-related enhancements:
● E1: enhancement1
● E2: enhancement2
● E3: enhancement3
● E4: enhancement4
The goal was to determine Psiphon’s adherence to secure coding best practices and to
provide safeguard recommendations where applicable.
During the test, a server configuration enabled with the aforementioned enhancements
was facilitated to the 7ASecurity team by Psiphon. This ensured the team could fully
focus on the security aspects during dynamic analysis of these new features at runtime
without wasting any time on setup.
7ASecurity employed a whitebox methodology, which means the complete source code
was available to the test team. Additionally, the Psiphon team provided commit links to
all relevant changes for these circumvention enhancement features, which were
reviewed thoroughly for adherence to security best practices. 7ASecurity used a
combination of manual and automated tools for the code audit, performed code-level
fuzzing on Psiphon source code as well as underlying third party libraries and
7ASecurity LLLP © 2020
3
Pentest Report
components, and network-level fuzzing using custom python scripts against both the
Psiphon server and client components. The team further analyzed the network traffic
between clients and servers. This guided the identification of potential attack vectors,
fingerprinting potential and the understanding of how the Psiphon server and its clients
switch from one tactic to another while they are under attack or when network
communications fail. Lastly, the 7ASecurity team examined multiple public academic
papers related to the new Psiphon circumvention enhancements to inform the fuzzing
and attack scenarios prior to testing.
The test was conducted by 7ASecurity in April 2021 and yielded five security-specific
discoveries. The security audit took a total of 18 working days and comprised three
senior 7ASecurity penetration testers. The Psiphon platform was found to be resilient to
a broad range of attack vectors and provided an overall solid impression. The system will
notably be more difficult to attack once the issues in this report are resolved.
In the following sections, the report will elaborate on each finding and then offer a
conclusion. Each finding has been discussed individually with its technical background
and mitigation options. 7ASecurity delivers a detailed conclusion in the closing section.
In light of the findings, the testing team comments on the security posture of the tested
Psiphon framework and circumvention enhancements manifested during this
assignment.
7ASecurity LLLP © 2020
4
Pentest Report
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation flaws identified during
the testing period. Please note that the findings are listed in chronological order rather
than by their degree of severity and impact. The aforementioned severity rank is simply
given in brackets following the title heading for each vulnerability. Each vulnerability has
additionally been given a unique identifier (e.g. PSI-01-001) for the purpose of facilitating
any future follow-up correspondence.
PSI-01-005 E2: Possible Client DoS via Traffic Tampering (Low)
While reviewing the circumvention enhancements related to enhancement2, the
7ASecurity team conducted thorough network traffic fuzzing attacks against both the
server and client components of Psiphon. In all cases, only the tested component was
inside a virtual environment while the traffic being sniffed and fuzzed passed through the
virtual network, making it easy to capture and manipulate. As a result, the team achieved
partial DoS success against the client component, manifested with forced reconnects,
failed proxy client download attempts, and unstable program behavior in rare attempts.
As these findings were difficult to replicate and Psiphon showed a great ability to recover
from these in most cases, the severity of this issue was set to Low. A malicious attacker
could attempt to leverage these weaknesses to initiate DoS attacks against Psiphon
clients hence disrupting Psiphon users, especially when they download large files.
Issue 1: DoS via tactic1 redacted packets
In order to test the Psiphon circumvention enhancements for enhancement2, tactic1
redacted attacks were emulated as used by the Great Firewall of China1, where three
specially crafted redacted packets were sent, trying to bring down the established
connection between the client and third-party server component (i.e. sponsor). Web
browser downloads proxied through the Psiphon client could be consistently stopped in
this fashion:
Fig.: Result of the successful redacted attack
1https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf
7ASecurity LLLP © 2020
5
Pentest Report
Consequently, Psiphon clients, in an attempt to mitigate the detected communication
problems, either reconnected or switched to alternative tactics.
Fig.: Reconnecting of Psiphon client after a successful redacted attack
This area was tested using the following PoC python script:
redacted attack PoC:
Redacted, shared with Psiphon Team
Following the redacted attacks, a slightly modified version of the presented script was
run, where a fake randomly generated (i.e. fuzzed) body was injected into the first reply
packet. The main goal was to disrupt the Psiphon tactic1 client-server communication
with a minimum number of packets, while forcing more time consuming client reconnects
or some other unstable program behavior.
This attack would be particularly disruptive to users downloading large files or videos, as
the download will be interrupted and render the downloaded file unusable. However,
Psiphon clients will eventually workaround tactic1 attacks if they switch to tactic2 tactics.
Issue 2: DoS via tactic2 traffic
Several tactic2 attacks were attempted during this assignment. As the goal was to
disrupt tactic2 communications, multiple strategies were implemented, where each one
was attempted individually, as well as concurrently. These were called replay, fuzz,
random, empty, big and reflect by the test team and are briefly explained below:
7ASecurity