Penetration Test Report (Cure53): pentest report onion browser

Pentest-Report Onion Browser 04.2014
Cure53, Dr.-Ing. Mario Heiderich / Abraham Aranguren / Alex Inführ
Index
Intro
Scope
Tes t Chronicle
Identified Vulnerabilities
OR -01-004 Information Leakage via Audio & Video Conten t ( Info )
OB -01-005 Third - Party Cookie Protection does no t work as expected ( High )
OB -01-006 Tor Bypass via Race Condition and iTunes URLs ( Critica l)
OB -01-009 SSL Certificate Warning Bypass via . onion Subdomains ( Critica l)
OB -01-010 Tor Bypass leaking User ’ s IP via WebSockets ( Critica l)
OB -01-011 Tor bypass via “ Define ” Functionality ( Medium )
OB -01-013 Lack o f Confirmation Dialog for “ onionbrowser : forcequi t ” URIs ( High )
OB -01-014 Cookie Blocker Bypass using Evercookie Features ( High )
OB -01-016 Active Conten t Blocking Bypass via Data URIs ( Critica l)
OB -01-017 Tor bypass via Protoco l Handler ( Critica l)
Miscellaneous Issues
OB -01-001 Information Leakage through iOS Screenshots ( Low )
OB -01-002 Insecure Browser Cookie Storage ( Low )
OB -01-003 Bug in Bookmark Encryption causes Information Leakage ( Low )
OB -01-007 Bug in Settings File Encryption causes Information Leakage ( Low )
OB -01-008 Weak Defaul t Configuration ( Info )
OB -01-012 Lack o f ASLR ( Medium )
OB -01-015 Information Leakage via Keyboard Cache ( Low )
Conclusion
Intro
“Onion Browser is a minimal web browser that encrypts and tunnels web traffic through
the Tor onion router network and provides other tools to help browse the internet while
maintaining privacy.”
From https :/ / mike . tig . as / onionbrowser /
This penetration tests against the Onion Browser software was carried out by three
testers from Cure53 Team and yielded an overall result of ten vulnerabilities and seven
general weaknesses which are all documented in this report. Given the purpose of the
application and the resulting threat-model, half of the ten spotted vulnerabilities were
classified as critical. The penetration test has taken place over a twelve days period.
The target in scope for this test encompassed a specific version of the Onion Browser
source code flagged as test-ready by Mike Tigas who maintains the project. Tests were
performed against the source code, the compiled app and the commercial app
downloaded from the iTunes Store on both the XCode iOS simulator and real devices.
Scope
• Onion Browser (Sources available)
◦ https :/ / github . com / mtigas / iOS - OnionBrowser
◦ https :/ / itunes . apple . com / us / app / onion - browser / id 519296448? m t=8
• Sources tagged as "v1.4.1", commit "ff69f9caf048a4b31e81aa54f5d02070654d62de".
◦ https :/ / github . com / mtigas / iOS - OnionBrowser / tree / v 1.4.1
◦ https :/ / github . com / mtigas / iOS - OnionBrowser / releases / tag / v 1.4.1
Test Chronicle
• 2014/04/28 - Penetration-Test begins
• 2014/04/28 - Setting up XCode, iPad, MacBook and necessary software
• 2014/04/28 - Setting up the latest 1.4.1 version in the test environment
• 2014/04/28 - Testing for file system leakage via iOS screenshots, added OB -01-001
• 2014/04/28 - Testing for file system leakage via Cookies, added OB -01-002
• 2014/04/28 - Testing for file system leakage via bookmarks, added OB -01-003
• 2014/04/28 - Testing for location leakage, added OB -01-004
• 2014/04/28 - Initial attempts at MiTM Attacks
• 2014/04/28 - Initial network traffic analysis
• 2014/04/28 - Testing for third-party cookie tracking, added OB -01-005
• 2014/04/28 - Testing the “block all cookies” feature
• 2014/04/29 - Additional testing for Tor leaks
• 2014/04/30 - Testing URL scheme handling, added OB -01-006
• 2014/04/30 - Initial attempts to bypass SOP via HTML downloads
• 2014/04/30 - Live-Reporting
• 2014/05/01 - Further code analysis and file-system protection tests
• 2014/05/01 - Added OB -01-007
• 2014/05/01 - Default configuration analysis, added OB -01-008
• 2014/05/02 - Testing for SSL certificate warning bypasses, added OB -01-009
• 2014/05/02 - Leakage Tests with the use of CORS
• 2014/05/02 - Leakage Tests with the use of WebSockets and protocol upgrades
• 2014/05/02 - Added OB -01-010, performed Live-Reporting
• 2014/05/02 - Tests for Leakage via CSP report-uri Header
• 2014/05/02 - Attempts to bypass JavaScript blocker
• 2014/05/02 - Trying to find more Tor bypasses, added OB -01-011
• 2014/05/02 - Verifying Stack Smashing Protection, passed
• 2014/05/02 - Verifying Automatic Reference Counting, passed
• 2014/05/02 - Verifying ASLR, added OB -01-012
• 2014/05/02 - Initial attempts to attack the Tor listener
• 2014/05/02 - Tests for DoS, added OB -01-013
• 2014/05/02 - Tests for side channel data leakage
• 2014/05/02 - Tests for SOP Bypasses
• 2014/05/03 - Tests for Cache Manipulations
• 2014/05/03 - Tests for Evercookies, added OB -01-014
• 2014/05/03 - Tests for XSS, SQLi against bookmarks
• 2014/05/03 - Tests for XML injection against homepage setting
• 2014/05/03 - Tests for information leakage via keyboard cache, added OB -01-015
• 2014/05/04 - Tests for bypassing active content filtering, added OB -01-016.
• 2014/05/05 - Additional Tor bypass tests via failed SSL handshakes
• 2014/05/05 - Looking for Format String vulnerabilities
• 2014/05/05 - Tests for app URL handler, added OB -01-017
• 2014/05/06 - Finalization of Pentest-Report
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
for the purpose of facilitating future follow-up correspondence.
OR-01-004 Information Leakage via Audio & Video Content (Info)
The Onion Browser website describes a known limitation that was verified during testing:
..Websites using HTML5 <video> tags may leak <video>-related DNS queries
and data transfer outside of Tor..1
Given that the problem is already known and was fully confirmed during our tests, we
decided to mark this issue with an “Info” tag rather than describing its severity. At the
same time, we decided to explore this problem to see what kind of data actually leaks,
and, furthermore, what kinds of mitigation approaches are possible.
An important detail listed neither on the homepage nor in the documentation is that
loading an audio/video via an iframe or the url bar is suffices to trigger the issue. The
only requirements are an HTTP 200 response code and a correct mime type. The
information should be covered in the documentation.
echo > test.mp3
echo > test.mp4
cat test_mtype.php
<?php
header('Content-Type: audio/mpeg');
xxx.xxx.xxx.xxx - - [05/May/2014:16:13:56 -0400] "GET /___c53_ob_test/test.mp3
HTTP/1.1" 206 333 "-" "AppleCoreMedia/1.0.0.11D201 (iPad; U; CPU OS 7_1_1 like
Mac OS X; es_es)"
xxx.xxx.xxx.xxx - - [05/May/2014:16:15:21 -0400] "GET /___c53_ob_test/test.mp4
HTTP/1.1" 206 332 "-" "AppleCoreMedia/1.0.0.11D201 (iPad; U; CPU OS 7_1_1 like
Mac OS X; es_es)"
xxx.xxx.xxx.xxx - - [05/May/2014:16:16:36 -0400] "GET
/___c53_ob_test/test_mtype.php HTTP/1.1" 200 225 "-"
"AppleCoreMedia/1.0.0.11D201 (iPad; U; CPU OS 7_1_1 like Mac OS X; es_es)"
Using a physical iPad in a test network environment with MiTM of DNS and HTTP traffic,
it was verified that the iOS Onion Browser leaks the following details to specific entities
outside of Tor:
1. The user’s IP address to the visited website
2. The HTTP request to the tracking website
1 https :/ / mike . tig . as / onionbrowser /
3. The DNS name to the fake DNS server
Below we delineate how the DNS name leak sent in the clear outside of Tor was verified
to have set up a fake DNS server with the use of the dnschef2 tool:
dnschef --interface=0.0.0.0 --truedomains=apple.com,icloud.com,skype.com
--fakeip=192.168.0.127
For the physical iPad scenario, the device was set to use the fake DNS server as a DNS
resolver in the network configuration settings, emulati