Penetration Test Report (Cure53): 1PW 23 Cure53 report 1Password Mobile.v2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report 1Password for Android & iOS 10.2022
Cure53, Dr.-Ing. M. Heiderich, MSc. H. Moesl, P. Einkemmer
Index
Introduction
Scope
Test Methodology
Key areas and coverage
Source code structure
Manual code auditing & pentesting
Mobile-specific security development
Critical user-flows
Features added in 1Password 8
Future testing
Conclusions
Cure53, Berlin · 11/15/22 1/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Introduction
“The 1Password you need to remember - With 1Password you only ever need to
memorize one password. All your other passwords and important information are
protected by your Master Password, which only you know.”
From https://1password.com/tour/
This report describes the results of a security assessment of the 1Password complex,
specifically targeting the 1Password 8 mobile applications and connected codebase,
with both Android and iOS branches covered. Carried out by Cure53 in October 2022,
the project included a penetration test and a dedicated audit of the source code.
Registered as 1PW-23, the project was requested by AgileBits Inc. dba 1Password in
August 2022 and then scheduled for mid-autumn 2022 to allow ample time for
preparations on both sides. To give some details, Cure53 is very much involved in
external testing of the 1Password scope, with this project being the twenty-third instance
of security-centered cooperation between the two entities. At the same time, since the
1Password complex is extensive, it is crucial to more precisely state that the mobile
applications have been tested by Cure53 exactly three times previously (see the reports
labeled 1PW-10, 1PW-19 and 1PW-20).
As for the precise timeline and specific resources, Cure53 completed the examination in
October 2022, namely in CW42. A total of ten days were invested to reach the coverage
expected for this assignment. What is more, a team comprising three senior testers has
been composed and tasked with this project’s preparation, execution and finalization.
For optimal structuring and tracking of tasks, the work was split into two separate work
packages (WPs):
• WP1: 1Password 8 mobile application codebase and mobile app for Android
• WP2: 1Password 8 mobile application for iOS
It can be derived from above that white-box methodology was utilized. Cure53 was
supplied with sources, binaries, test-user-accounts, as well as various other means of
accessing the scope, as dictated by the project requirements. Additionally, detailed
information about the scope was shared with the testing team to make sure the project
can be executed in line with the agreed-upon framework.
Cure53, Berlin · 11/15/22 2/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
The project progressed effectively on the whole. All preparations were done in CW40 to
foster a smooth transition into the testing phase. Over the course of the engagement, the
communications were done using a private, dedicated and shared Slack channel, which
could be joined and used by all relevant personnel from Cure53 and 1Password.
The discussions throughout the test were very good and productive and not many
questions had to be asked. Ongoing interactions positively contributed to the overall
outcomes of this project. The scope was well-prepared and clear, greatly contributing to
the fact that no noteworthy roadblocks were encountered during the test.
Cure53 offered frequent status updates about the test and the emerging findings. Live-
reporting was deemed unnecessary, since no findings were actually uncovered during
this examination.
It is a very rare occurrence that the testing team actually has no findings to report. In
other words, neither security vulnerabilities nor even general weaknesses could be
spotted as negatively affecting the targets of this 1PW-23 project. Quite clearly, the total
absence of problems must be interpreted as a very good sign and showcases that the
1Password 8 mobile applications boast a very good security posture on the whole. The
team of 1Password is hereby congratulated for their excellent work on achieving well-
secured and robust applications.
Yet, some caveats should be considered in the context of the evaluation. Specifically,
while the scope was clearly defined, Cure53 had difficulty in achieving deep-dives into
every aspect of the applications, given the significant complexity. Yet, basic coverage
levels over all relevant scope items was achieved.
In the following sections, the report will first shed light on the scope and key test
parameters, the available testing material, as well as the structure and content of the
WPs. A dedicated chapter on test methodology and coverage then clarifies what the
Cure53 team did in terms of attack-attempts, coverage and other test-relevant tasks.
Especially in light of no findings, this is intended as a way to transparently guide the
1Password through the tasks and attack attempts completed by the testing team.
Finally, the report will close with broader conclusions pertinent to this October 2022
project. Cure53 elaborates on the general impressions and reiterates the verdict about
the 1Password 8 mobile applications and code for Android and iOS branches, basing
their opinion on the testing team’s observations and collected evidence.
Cure53, Berlin · 11/15/22 3/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration tests & Audits against 1Password 8 React Native mobile applications
◦ WP1: 1Password 8 mobile application codebase & Mobile app for Android
▪ All important material, sources and binaries were shared with Cure53:
• App was made available via sharing the respective binary
• App binary was shared
• App source code was provided
▪ Special focus areas:
• Mobile-specific security development
• Critical user-flows
• Features added in 1Password 8 (best effort)
• Detailed testing notes that supplied further information about the scope and
coverage expectations were shared
◦ WP2: 1Password 8 mobile app for iOS (respective diff between WP1 and WP2)
▪ All important material, resources and binaries were shared with Cure53:
• App was made available via a Testflight invitation
• App binary was supplied
• App source code was shared
▪ Special focus areas:
• Mobile-specific security development
• Critical user-flows
• Features added in 1Password 8 (best effort)
• Detailed testing notes that supplied further information about the scope and
coverage expectations were shared
• Test-accounts utilized in this assessment:
◦ Test-user creation URL:
▪ https://start.b5test.com/sign-up/plan
◦ Test environment URL:
▪ https://my.b5test.com
◦ Account #1 (personal):
▪ U: cure53_1pw23_1
◦ Account #2:
▪ U: cure53_1pw23_2
◦ Account #3:
▪ U: cure53_1pw23_3
Cure53, Berlin · 11/15/22 4/13
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
• Relevant areas in the shared sources:
◦ Android biometrics:
▪ foundation/op-system-auth/android.rs
▪ foundation/op-enclave/keychain_store.rs
◦ Lock screen handling (iOS):
▪ op-auto-lock/apple.rs
▪ apple/CoreFoundation/CoreFoundation/AutoLockMonitor.swift
▪ op-app/src/app/backend/lock_screen.rs
◦ Unlocking the app:
▪ data/op-unlock
▪ /op-data-layer/src/unlock.rs
◦ React Native bridging on iOS:
▪ apple/iOS/ReactNative
▪ apple/1PasswordFrameworks/Common/React Native
◦ React Native bridging on Android:
▪ android/app/src/main/java/com/onepassword/android/itemdetail/
ShareItemFragment.kt
◦ Authentication to 1Password:
▪ op-b5-client/src/internal/keyed_server_connection.rs
▪ op-b5-client/src/internal/unauthorized_session.rs
▪ op-app/src/app/backend/signin.rs for some sign-in logic
◦ MFA-related authentication to 1Password
▪ ffi/op-core-android/src/lib.rs
▪ ffi/op-core-apple/src/lib.rs
▪ op-app/src/b5ui.rs
◦ Imports handling:
▪ op-app/src