Penetration Test Report (KudelskiSecurity-X41): X41 Kudelski Wire Security Review iOS

WireSecurityReview–Phase2–iOSClient
forWireSwissGmbH
FinalReport
2018-03-07
FORPUBLICRELEASE
Contents
1 Summary 2
2 iOSClientReview 3
2.1 Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5 Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.6 CodeQuality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.7 ImplementationSecurityIssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.8 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3 About 24
1
1 Summary
This report is a review of Wire’s iOS application security and privacy, describing
strengthsandlimitations,andhighlightinganumberofminorshortcomingsandpotential
improvements. We also report one low-severity software bug and three
medium-severitybugs.Thesourcecodeauditotherwisereflectedadherencetosecure
softwaredevelopmentprinciples,aswellasleverageoftheplatform’ssecurityfeatures.
As noted throughout the report, Wire has adequately addressed the security issues
reported.
Thisreviewdoesnotcover:
• ThecorecryptographycomponentProteus,previouslyalreadyreviewed1.
• Thecallingmechanism,coveredinaseparatereview.
• Codeofthird-partydependencies.
The work was performed between August and November 2017, by Jean-Philippe
Aumasson(KudelskiSecurity)andMarkusVervier(X41D-SecGmbH).Atotalof10.75
person-dayswerespent.
1
https://www.x41-dsec.de/reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf
2
2 iOS Client Review
WereviewedsecurityandprivacyfeaturesoftheWireiOSclient,mainlybasedonthe
sourcecodereview,aswellasondynamicanalysisoftheofficialWireapplicationusinga
jailbroken device and test devices. The following sections review how the Wire iOS
application protects against various technical risks, highlighting potential issues and
providing mitigation recommendations. Several observations were made on older
versionsoftheapplications(asofAugust2017), butallobservationsreportedinthis
versionofthereportapplytotheversionavailablemidNovember2017.
Subjectofthereviewwerethefollowingrepositoriesandcommits:
• wire-ios-cryptoboxcommit8e96cccb35b259187e590ca75e969cde7a6e2efd
• wire-ios-data-modelcommit[PII_REDACTED]4dfcd017154d4e[PII_REDACTED]0d956e
• wire-ios-imagescommitba105ea632251fcadd9f388ed319e8300164ace9
• wire-ios-message-strategycommit22e7c4210e10acfc37963b3f2e2e108496a48190
• wire-ios-share-enginecommit1aba9b92931073d6050cecc18059863cf7ebe1d2
• wire-ios-sync-enginecommitdd66a9fc2a056e320a2f62fca277cb233042147f
• wire-ios-systemcommitdb0abf2504f16b4c2ae67e6feaa454d1c08d843b
• wire-ios-transportcommit967db[PII_REDACTED]aa59b101139b6731b61977a3c
• wire-ios-utilitiescommit55f2bf21439d49b0018de18de71eb7c9a4658ba7
3
WireSecurityReview–Phase2–iOSClient WireSwissGmbH
2.1 P
RIVACY
Thissectionsummarizesourreviewofpotentialprivacyleaks.
2.1.1 LogsLeaks
Logs written (in non-debug mode) do not leak critical credentials, but may leak
informationontheuser’sidentityanditsactivity.Forexample,URLsareloggedinerror
messagesinSharedObjectStore.swift:
1 zmLog.error("Failed to write to url: \(url), error: \(error), object: \(object)")
2 zmLog.error("Failed to read from url: \(url), error: \(error)")
3 zmLog.error("Failed to remove item at url: \(url), error: \(error)")
Listing2.1:Logging
Furthermore,auserIDisloggedinanerrormessageinMissingClientsRequestStrateg
y.swift:
1 zmLog.error("\(userIdString) is not a valid UUID")
Listing2.2:UserIDLog
Werecommendtoreviewwhethersuchlogsarereallynecessary.
2.1.2 UninstallLeftovers
Afteruninstallingtheapplication,allfilesunder/private/var/mobile/Containersare
removed, as well the localytics folder in file sharing, and the application. One can
nonethelessfindoutthatWireusedtobeinstalledonthedevice,forexamplebylooking
atiOSlogfiles,wherethementionof“wearezeta”(Wire’soriginalcodename)revealsthe
previousinstallationoftheapp.
1 lockdownd.log: 0 : <CFString 0x13c603b60 [0x1a1785b68]>{contents = "com.wearezeta.zclient.ios"}
2 lockdownd.log.1: 0 : <CFString 0x14c60b360 [0x19e399b68]>{contents = "com.wearezeta.zclient.ios"}
FORPUBLICRELEASE Page4of25
WireSecurityReview–Phase2–iOSClient WireSwissGmbH
Listing2.3:UninstallLeftovers
However, this behavior cannot be modified by the application’s developers, as it is a
propertyoftheOS.
2.1.3 TelemetryData
Localyticsisusedtoperformanalyticsbasedonuserusagedata.Userscanoptoutofthis
trackinginthesettings,butbydefaultdatasuchasthefollowingistracked:
• Typeofconnection(WiFi,4G,etc.).
• Thetime,size,andtypeofassetsexchanged(photo,audio,video,orotherfiles).
• Callsdurationandtype(audioorvideo),etc.
Suchdatacanobviouslyleakprivacy-sensitiveinformation, evenifthedataisshared
anonymously.WiremigratedtoMixpanelduringthereview.Thereviewedcodewasstill
usingLocalytics.
2.1.4 CrashReports
HockeyApp is used to collect and crash reports from the application and share them
with Wire for QA purposes. These reports do not seem to include obvious sensitive
information.Butstacktracesandexceptionmessagesmayrevealpotentiallysensitive
information.Userscanoptoutofthistrackinginthesettings.
2.1.5 ScreenCopies
Theapplicationdoesnotattempttoprotectagainstscreenshots.
BydefaulttheiOSappswitchershowsapreviewofthecurrentWirescreen,anddoesnot
attempttohidesensitivedatasuchasconversationscontent.However,theapplication
lockmechanismcanbeactivatedtorequireauthenticationbeforeusingtheapp,andthis
willhidethecontentoftheapplicationintheappswitcher.
FORPUBLICRELEASE Page5of25
WireSecurityReview–Phase2–iOSClient WireSwissGmbH
2.1.6 FilesMetadata
Imagessentovertheapparestrippedoftheirmetadatasuchasforexamplegeotags.
Thisappliestophotostakenfromtheapporpicturesfromtheimagegallery.Thecode
performingtheclean-upisinNSData+MediaMetadata.swiftfoundinthewire-ios-ima
gerepository.
Locationinformationisremovedfromvideos,bothwhensentasafileandwhensentfrom
theimagegallery.Thisseemstohappenthroughtranscodingofthefilesfromtheoriginal
format(e.g..mov)tocompressedMP4format.
Otherfilesuploadedleftunchanged.Thisincludesofficedocuments,audiofiles,PDFs,
andotherdocuments.
2.1.7 URLPreviews
Bydefault,previewsofURLsaregeneratedwhenanURLisentered,therebygeneratinga
DNSrequestandsubsequentHTTPrequeststofetchthepreviewcontent.Thisbehavior
leakstheaddressofthesendertotheURL’sservers,andrevealsthattheURLwassent.
Wire has addressed this issue by allowing users to disabled URL previews under
Settings>Options.
2.1.8 iCloudBackupsandiTunesBackups
WiredataisexcludedfromiCloudandiTunesbackupsbytheapplication,asimplemented
inFileBackupExcluder.swift.
2.1.9 ScreenSnapshots
Appswitcherscreensnapshotsarestoredunder/private/var/mobile/Containers/D
ata/Applications/<appID>/Library/Caches/Snapshots/.However,anyinformation
willappearonthesnapshot,forexamplethepasswordlengthandthecleartextvalue
of the last password character on the login page. Such sensitive information should
behidden,usingtheapplicationDidEnterBackgroundmethod.Pleaseseealsosection
FORPUBLICRELEASE Page6of25
WireSecurityReview–Phase2–iOSClient WireSwissGmbH
2.1.5forfurtherinformation.
2.1.10 KeyboardCaching
Keyboardcachingisdisabledforpasswordfields(through.secureTextEntry=YES)as
wellasforusernameandemailfields(through.autocorrectionType=UITextAutocorr
ectionTypeNo).ThisensuresthatsensitivedataisnotrecordedbytheOS.
2.2 C
RYPTOGRAPHY
Thissectionreportsonthemaincryptographicthreatsagainsttheapplication.
2.2.1 PseudorandomGenerator
ThePRNGusedforcryptographicpurposesreliesontheiOSSDK’sSecRandomCopyBytes
usingthedefaultsystemsecurePRNG(kSecRandomDefault),andproperlycheckingfor
success:
1 + (NSData *)secureRandomDataOfLength:(NSUInteger)length
2 {
3 NSMutableData *randomData = [NSMutableData dataWithLength:length]