Penetration Test Report (Cure53): analysis report ijop

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Analysis-Report Chinese Police App “IJOP” 12.2018
Several Members of the Cure53 Team
Index
Introduction
Scope of the Assessment
Classification of Findings
Questions & Answers
XJ1-01-001 WifiDetector class implementing War Driving database (Assumed)
XJ1-01-002 NewCollection activity tracks blood type and political views (Proven)
XJ1-01-003 App feature of scanning for book titles (Unclear)
XJ1-01-004 Local database of religious atmosphere & re-education (Assumed)
XJ1-01-005 App receives electricity consumption data from HQ (Proven)
XJ1-01-006 Reporting feature for problematic tools (Proven)
XJ1-01-007 Problem Survey Feed tracks the use of crypto tools & VPNs (Evident)
XJ1-01-008 PII collection via OverduePersonAddFeedActivity (Assumed)
XJ1-01-009 PII collection via SuspiciousPhone[List]Activity (Assumed)
XJ1-01-010 PII collection via PeerPersonnel Add/List activities (Assumed)
XJ1-01-011 PII collection via MapRadioPersonnelDetailActivity (Assumed)
XJ1-01-012 PII data via OutOfPersonDetailActivity (Assumed)
XJ1-01-013 PII data via InfluxPersonDetailActivity (Assumed)
XJ1-01-014 PII collection via MissPhoneTrailFeedbackActivity (Assumed)
XJ1-01-015 PII collection via FourAssociationFeedbackActivity (Assumed)
XJ1-01-016 PII collection via VehicleAddActivity (Assumed)
XJ1-01-017 PII collection via ToolsAddActivity (Assumed)
XJ1-01-018 PII collection via BankAddActivity (Assumed)
XJ1-01-019 Mention of the 26 sensitive countries for Uyghurs (Unclear)
XJ1-01-020 Usage of the terms “Picked” and “Radio” (Unclear)
XJ1-01-021 Usage of the terms “illegal”, “suspicious” and “problem” (Unclear)
XJ1-01-022 HQ communications for investigations and arrest (Assumed)
XJ1-01-023 Review of Warn activities (Unclear)
Cure53, Berlin · 06/14/19 1/51
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
XJ1-01-024 Review of AntiRefluxActivity (Assumed)
Conclusions
Appendix
Appendix 1: Working version of app APK and instructions on how to use it
Appendix 2: Guide for checking relations between activities
Introduction
“The Integrated Joint Operations Platform (IJOP) is a policing program based on big
data analysis in Xinjiang, one of the most repressive regions in the world. The program
aggregates data about people – often without their knowledge – and flags those it
deems potentially threatening to officials.”
From Memo on IJOP provided by HRW
This report documents the findings of a Cure53 assessment targeting the Integrated
Joint Operations Platform (IJOP) mobile app. This project was requested by Human
Rights Watch (HRW) and funded by Open Technology Fund (OTF). The main objective
of the assessment was to find out whether the IJOP mobile application compound could
violate human rights.
More specifically, Cure53 carried out a source code audit and a dedicated review of the
IJOP mobile application in late November 2018. The project followed a so-called white
box methodology as much as possible, particularly in a sense that the assessment
included reviewing and targeted investigations of the decompiled source code of the
application, which had been made available to Cure53 as an APK file by the HRW. In
addition, HRW furnished other, previously acquired data and material to Cure53, so that
a better coverage could be accomplished.
The assessment took a total of ten days, excluding a separate budget allocated to
preparations, communications and write-up of this report. Note that the project was
executed stealthily, as the Cure53 team aimed at avoiding detection. This meant
refraining from any form of behavior that could be perceived as “noisy” and, thus, alert
the maintainers of the application and/or server owners. As noted above, the
assessment tackled both the application source code and the running application which
has been repacked with English translations. The project also entailed a review of the
APK-exposed activities.
Throughout this assignment, the Cure53 and HRW teams maintained frequent contact
on a shared Slack channel. This allowed for fast communications and a good flow during
Cure53, Berlin · 06/14/19 2/51
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
the test, additionally ascertaining that Cure53 does not pursue exploration avenues and
directions useless from the HRW’s point of view.
In should be emphasized that the European Convention on Human Rights (ECHR)
served as a baseline for this project. To reiterate, Cure53 set out to determine - through
the technical reviews and audits - what communication capabilities and functionality of
the IJOP mobile application can be seen as standing in direct opposition to what the
ECHR guarantees. Therefore, this was a search for any human rights violations that the
IJOP’s operational scope could enable and facilitate.
For the purpose of documenting the findings, Cure53 devised a classification system
that could help discern the level of harm and certainty about each potential violation of
human rights. This system is discussed in more detail below. At this stage, it can
nevertheless be stated that Cure53 managed to prove four cases of clear human rights
violations. All other items, in a vast array of as many as twenty-four total discoveries,
should also be considered, yet only in the context of having all vital information at hand.
In other words, twenty suspicious behaviors should be evaluated by HRW further as to
whether the supplied evidence is sufficient or needs to be extended with more data.
In the following sections the report first elaborates on the scope and then sheds light on
the link between severities of the findings and the employed classification system. The
questions posed by HRW, along with detailed answers and research results, are
discussed next. Further, Cure53 reiterates some of the key points in the Conclusions
and, last but not least, supplies a selection of attachments that are relevant to this report.
It is hoped that this will facilitate possible follow-up research or other actions that will be
taken by HRW or any other involved or interested parties.
Scope of the Assessment
• Chinese Police App
◦ In scope of the assessment was a mobile application for Android phones. The
application (labelled as IJOP) is supposedly used in specific regions of China by Law
Enforcement personnel to gather and manage data about specific groups of citizens
and/or minorities.
◦ In a nutshell, Cure53 got access to the APK of the app through HRW and was tasked
with finding out what the app is capable of doing. Of particular importance was
whether the activities and features of the app could be used in a way that violated
human rights.
◦ Cure53 received thorough briefing from HRW about the context of this assessment
and communicated with the HRW team using a dedicated Slack channel.
◦ Additional material that was collected by HRW prior to the assessment was also
Cure53, Berlin · 06/14/19 3/51
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
shared with Cure53. It showed that HRW also disassembled the apps and started
initial research into the identified features and activities.
Classification of Findings
During this assessment, Cure53 team has been using the following classification to
specify the level of certainty regarding the documented findings. Given that this research
had to happen on the basis of reverse-engineering and needed to be executed in a
stealthy manner, it is necessary to classify the findings to make sure which level of
reliability can be assumed.
• Proven - Source code and the analyzed activity clearly indicate a HR violation.
• Evident - Source code strongly suggests a HR violation.
• Assumed - Indications of a HR violation were found but a broader context
remains unknown.
• Unclear - Initial suspicion was not confirmed. No HR Violation can be assumed.
Questions & Answer