Penetration Test Report (QuarksLab): 14 03 022 ChatSecure sec assessment

ChatSecure security assessment
Technical report
Ref 14-03-022
Version 1.0
Date June 25, 2015
Quarkslab SAS
71 – 73 avenue des Ternes
75017 Paris
France
Table des matières
1 Executive summary 4
2 Vulnerability list 5
3 Introduction 6
3.1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.2 Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.3 Security audit methodology . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.3.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.3.2 Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4 Chatsecure cartography 9
4.1 Statically linked dependencies . . . . . . . . . . . . . . . . . . . . . . . . 9
4.2 Dynamically linked dependencies . . . . . . . . . . . . . . . . . . . . . . 12
4.3 Summary of library versions . . . . . . . . . . . . . . . . . . . . . . . . . 13
5 Code audit 16
5.1 Automated code analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.2 Manual code review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5.3 AIM additional commands . . . . . . . . . . . . . . . . . . . . . . . . . 20
6 Web related vulnerabilities 21
6.1 HTML in the display window . . . . . . . . . . . . . . . . . . . . . . . . 21
6.2 Linkification of non-http URL . . . . . . . . . . . . . . . . . . . . . . . . 21
6.3 Possible information leak via SRV records . . . . . . . . . . . . . . . . . 21
7 XML Fuzzing 22
7.1 Low-level libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
7.2 High-level libraries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
7.3 Fuzzing setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
7.3.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
7.3.2 eJabber configuration file . . . . . . . . . . . . . . . . . . . . . . 23
7.3.3 Modified tcpprox . . . . . . . . . . . . . . . . . . . . . . . . . . 23
7.4 Features abuse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
8 Protocol Security 25
8.1 AIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
8.1.1 User authentication . . . . . . . . . . . . . . . . . . . . . . . . . 25
8.1.2 Message encryption . . . . . . . . . . . . . . . . . . . . . . . . . 25
8.1.3 Message server authentication . . . . . . . . . . . . . . . . . . . 25
8.1.4 OTR attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.1.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.2 Google Talk / Facebook . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.2.1 User authentication, Message encryption, Message server authen-
tication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.2.2 OTR Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
ChatSecure security assessment
8.2.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
8.3 Jabber (XMPP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
8.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
9 Cryptography assessment 28
9.1 Generalities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
9.2 Protocol layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
9.3 SSL layer and certificates pinning . . . . . . . . . . . . . . . . . . . . . . 29
9.4 Secrets in memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
9.5 OTR protocol security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
9.5.1 Overall process . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
9.5.2 OTR inside ChatSecure . . . . . . . . . . . . . . . . . . . . . . . 33
9.5.3 Implementation failures . . . . . . . . . . . . . . . . . . . . . . . 33
9.5.4 Notes on SMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
10 Forensics resilience 41
10.1 Default protection for files . . . . . . . . . . . . . . . . . . . . . . . . . . 41
10.2 Passwords of accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
10.2.1 OSCAR and Jabber accounts . . . . . . . . . . . . . . . . . . . . 41
10.2.2 Facebook and Google Talk kind of accounts . . . . . . . . . . . . 42
10.3 History of messages and meta-data . . . . . . . . . . . . . . . . . . . . . 42
10.4 OTR keys and private data . . . . . . . . . . . . . . . . . . . . . . . . . 44
10.5 Keyboard cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
10.6 Application view snapshots . . . . . . . . . . . . . . . . . . . . . . . . . 45
11 Recommendations 46
11.1 Remediation plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
11.2 Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
11.3 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
11.4 User experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Ref.: 14-03-022 Quarkslab 3
ChatSecure security assessment
1. Executive summary
The assessment has been ordered by OpenITP (http://www.openitp.org), and
performed by Quarkslab (http://www.quarkslab.com) with the help of Agarri
(http://www.agarri.fr), 2 french security companies.
Critical MitM on Gtalk, Jabber or Facebook
An attacker could build a rogue XMPP server and intercept all traffic bet-
ween a given user and Gtalk, Jabber or Facebook because the application
does not enforce the XMPP STARTTLS option.
Critical MitM with OTR
Users’ DSA key fingerprints are badly verified in the application as it hap-
pens only on the manual user’s request. The end-user could also wrongly
trust that the chat has been secured relying on the highlighted padlock
and the “the chat is secured” message, which does not mean that the
fingerprint has been validated against the local database.
Critical Additional sensitive commands in AIM protocol
Commands have been added to the AIM protocol allowing any user to
retrieve sensitive information about other users, like blist to get a contact
list.
Also, AIM protocol implementation is vulnerable to multiple flaws.
The full vulnerability list is available on next page.
Ref. : 14-03-022 Quarkslab 4
ChatSecure security assessment
2. Vulnerability list
Here is a summary of most vulnerabilities and flaws that has been found during the
audit. Complete details are available in the next report sections and each entry in the
following list is associated to a specific action in the remediation plan (see chapter. 12) :
Attack
No Vulnerabilities / flaws Risk Impact
difficulty
MitM
AIM protocol implementation is vulnerable to
1 Critical attack - Easy
multiple flaws
DoS
AIM protocol : debugging commands allow any
2 user to retrieve sensitive information about other Critical Data theft Easy
users
STARTTLS protocol usage is not enforced for MitM
3 Critical Easy
Gtalk and Facebook attack
DSA public key fingerprints are not validated at OTR
4 every OTR negociation and this must be done Critical MitM Medium
manually attack
DoS - in-
Multiple vulnerabilities have been detected inside
5 Medium formation Medium
ChatSecure and its libraries
leak
NSFileProtectionCompleteUnlessOpen is not Data theft
6 Medium Easy
used to protect sensitive files - MitM
7 Data and messages persist in SQLite database Medium Data theft Easy
kSecAttrAccessibleWhenUnlockedThisDeviceOnly Credential
8 Medium Medium
is not used with keychain API theft
Multiple common libraries are taken from forked
9 Low - -
repositories
Passwords and OAUTH tokens are not securely Credential
10 Low Medium
erased from memory theft
OTR
11 SMP protocol implemented in libotr is not used Low MitM High
attack
OTR
End-user is not well informed of the current pro-
12 Low MitM Medium
tection level
attack
13 All strings containing " ://" are linkified Low Phishing Low
Usersarenotnoticedtouselastoperatingsystem
14 Low - -
updates
Ref. : 14-03-022 Quarkslab 5
ChatSecure security assessment
3. Introdu