Penetration Test Report (7ASecurity): pentest report leavehomesafe

Test Targets:
LeaveHomeSafe Android app
LeaveHomeSafe iOS app
Pentest Report
Client:
Hong Kong Democracy Council
7ASecurity Test Team:
● Abraham Aranguren, MSc.
● Various 7ASecurity members
7ASecurity
Protect Your Site & Apps From Attackers
sales@7asecurity.com
Pentest Report
INDEX
Introduction 3
Scope 5
Identified Vulnerabilities 6
LHS-01-001 WP1: MitM without Warnings via invalid TLS Certificates (Critical) 6
LHS-01-003 WP1: Leaks via Missing Security Screen on Android & iOS (Low) 13
LHS-01-007 WP1: COVID Status Access via Unsafe SD Card Usage (High) 16
LHS-01-008 WP1: COVID Status Access via Auth Bypass (High) 18
LHS-01-009 WP1: Weaknesses in iOS Keychain usage (Medium) 21
LHS-01-010 WP1: COVID Status Access via missing Data Protection (Medium) 23
LHS-01-011 WP1: Possible App Notification Access via iOS Backups (Low) 25
Hardening Recommendations 26
LHS-01-004 WP1: Missing Jailbreak/Root Detection on Android & iOS (Info) 26
LHS-01-005 WP1: Support of Insecure v1 Signature on Android (Info) 27
LHS-01-006 WP1: Android Binary Hardening Recommendations (Info) 28
LHS-01-012 WP1: Usage of Insecure Crypto functions and PRNG (Medium) 30
Privacy Analysis Findings 34
LHS-01-Q02 WP2: Files & Information gathered by LeaveHomeSafe (Assumed) 34
LHS-01-Q03 WP2: Where & How LeaveHomeSafe transmits Data (Unclear) 36
LHS-01-Q04 WP2:LeaveHomeSafe fails to protect PII at rest & in transit (Proven) 37
LHS-01-Q05 WP2: Visit Record Weaknesses in Transit & at Rest (Proven) 37
LHS-01-Q06 WP2: Presence of Face Recognition Code (Evident) 38
LHS-01-Q08 WP2: LeaveHomeSafe insecure SD Card Usage (Proven) 44
LHS-01-Q09 WP2: Potential LeaveHomeSafe RCE Issues (Unclear) 45
LHS-01-Q10 WP2: Potential LeaveHomeSafe Backdoors (Unclear) 45
LHS-01-Q13 WP2: Identification of Companies behind LeaveHomeSafe (Evident) 49
LHS-01-Q14 WP2: LeaveHomeSafe vs. Study the Great Nation Relation (Unclear)51
Conclusion 52
7ASecurity © 2022
2
Pentest Report
Introduction
“Let's Fight the Virus! Scan with "LeaveHomeSafe"[...]
help protect the community while protecting your privacy.”
From: https://www.leavehomesafe.gov.hk/en/
This document outlines the results of a blackbox security review and a privacy audit
conducted against the LeaveHomeSafe solution. The project was solicited by the Hong
Kong Democracy Council (HKDC), funded by the Open Technology Fund (OTF), and
executed by 7ASecurity in April and May 2022. The audit team dedicated 17 working
days to complete this assignment.
The background of this project is to address the general concern about the potential
security and privacy risks that might be introduced by the LeaveHomeSafe Android and
iOS applications12. Please note that this COVID-19 digital contact tracing application is
mandated in all government venues, hospitals, markets, shopping malls, supermarkets
and places of worship, among other places in Hong Kong at the time of writing34.
The goal of this engagement was therefore to have an independent third party verify
whether the official LeaveHomeSafe privacy and security claims are accurate.
7ASecurity downloaded and reviewed the official LeaveHomeSafe Android (3.1.0, 3.2.0,
3.2.3) and iOS (3.1.0, 3.2.0, 3.2.3) applications, which were the latest available during
this assignment. Please note retests were performed against LeaveHomeSafe 3.3.0 and
3.4.0, after the disclosure process.
The methodology implemented was blackbox. The 7ASecurity team had no access to
test users, documentation or source code. The lack of Hong Kong Health Code System
credentials, valid vaccination status QR codes and valid COVID testing status QR codes
were major limitations during this assignment, as the testers could not fully exercise the
application logic in those functional areas. All efforts were therefore focused on reverse
engineering, decompiling the applications and analyzing their behavior at runtime. A
team of 4 senior auditors executed all tasks required for this engagement, including
preparation, delivery, documentation of findings and communications.
All necessary arrangements were in place by March and April of 2022, to facilitate a
straightforward commencement for 7ASecurity. In order to enable effective collaboration,
information to coordinate the test was relayed through email as well as a shared Signal
1https://www.bloomberg.com/news/articles/2022-02-21/hong-kong-s-contact-tracing-app-...
2https://www.scmp.com/news/hong-kong/health-environment/article/3166508/tracking-function-...
3https://en.wikipedia.org/wiki/LeaveHomeSafe#Mandatory_use
4https://zh.wikipedia.org/wiki/...
7ASecurity © 2022
3
Pentest Report
chat group. The Hong Kong Democracy Council (HKDC) and OTF were helpful and
responsive throughout the audit.
The project was competently defined and organized, which facilitated the audit for the
test team. As a result, the testers did not have the need to frequently ask or wait for
answers, and hence, there were no notable blockers during this iteration. Overall, the
test went well and 7ASecurity provided regular updates regarding the audit status and its
interim findings during this exercise.
This exercise split the scope items in the following work packages, which are referenced
in the ticket headlines as applicable:
● WP1 - Mobile Security tests against LeaveHomeSafe Android & iOS apps
● WP2 - Privacy tests against LeaveHomeSafe Android & iOS apps
The findings of the security audit (WP1) can be summarized as follows:
Identified Vulnerabilities Hardening Recommendations Total
8 4 12
Please note that 3 of the findings in this report had an estimated severity level of high or
critical. This poor result strongly suggests that the LeaveHomeSafe mobile apps have
not been audited by any competent security firm previously. This is in stark contrast to
the documentation in the official LeaveHomeSafe website, which indicates the mobile
applications were audited previously on December 10th 20215, without any significant
findings.
Please note that this audit was followed by a 30 day disclosure process in which
7ASecurity repeatedly sent the report to the vendor, and offered assistance to clarify any
queries6. Unfortunately, these disclosure attempts were ignored until the report was
public, at this stage the Office of the Government Chief Information Officer (OGCIO)
simply attempted to save face by downplaying the findings7.
Subsequently, the high and critical security issues were confirmed to remain unfixed on
July 29th 2022 against LeaveHomeSafe 3.3.0, after the OGCIO press release. A more
comprehensive retest was then performed on August 22nd 2022 against
LeaveHomeSafe 3.4.0, where most issues, including the critical one, were confirmed to
remain unfixed. However, some medium severity findings were silently patched without
5https://www.leavehomesafe.gov.hk/en/technical-document/
6https://7asecurity.com/blog/2022/07/leavehomesafe-android-ios-apps/
7https://www.info.gov.hk/gia/general/202207/28/P[PII_REDACTED]632.htm
7ASecurity © 2022
4
Pentest Report
notifying the public. Please note that details about these retests can be found at the top
of each finding, where a brief retest summary is provided, and in some cases a link to a
demo.
Regarding the privacy audit (WP2), 7ASecurity directly answers 13 privacy-related
questions with a confidence level ranging from Unclear to Proven. These are described
in the Privacy Analysis Findings section of this report.
Moving forward, the scope section elaborates on the items under review, and the
findings section documents the identified vulnerabilities followed by hardening
recommendations with lower exploitation potential. Each finding includes a technical
description, a proof-of-concept (PoC) and/or steps to reproduce if required, plus
mitigation or fix advice for follow-up actions by the development team.
Finally, the report culminates with a conclusion providing detailed commentary, analysis,
and guidance relating to the context, preparation, and general impressions gained
throughout this test, as well as a summ