Penetration Test Report (iSEC): NCC Group   Ricochet

Ricochet Security Assessment
Ricochet
February 15, 2016 – Version 1.2
Preparedfor
JohnBrooks
Preparedby
JesseHertz
PatricioJara-Ettinger
MarkManning
©2016–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forRicochet. Portionsofthisdocumentandthetemplatesusedinitsproduction
arethepropertyofNCCGroupandcannotbecopied(infullorinpart)withoutNCCGroup'spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,andtheauthor(s)assumeno
responsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformationcontainedherein.UseofNCCGroup's
servicesdoesnotguaranteethesecurityofasystem,orthatcomputerintrusionswillnotoccur.
2|RicochetSecurityAssessment
Executive Summary
Synopsis KeyFindings
RicochetandtheOpenTechnologyFundengagedNCC The assessment identified multiple areas of improve-
GrouptoperformanassessmentoftheRicochetanony- ment that include one issue given a High risk rating.
mous messaging application. Two NCC Group con- Many of the findings are provided as a defense-in-
sultantsperformedtheassessmentbetweenNovember depth approach for developers to continue to focus
16th and 25th. The engagement was conducted as a their effort. The source code assessment identified
sourcecodereviewwithafocusonidentifyingcommon input validation issues that were already known to the
C++ vulnerabilities, privacy influencing vulnerabilities, developer, and have issues filed in GitHub. These
as well as to provide recommendations based on include:
securitygapsvsbestpractices.
• IssueswithHTMLbeingincludedincontactrequests,
Ricochet expressed particular interest in the discovery leading to de-anonymization if the request is ac-
ofvulnerabilitiesthat,ifexploited,couldleadtothede- cepted.
anonymization or exploitation of Ricochet users. NCC • Issues with Unicode processing leading to homo-
Group focused its testing efforts on attempting to find graph or other phishing attacks, both on links
vulnerabilitieswiththeseimpacts. or in contact nicknames. These could allow de-
anonymizationorcompromiseofuserprivacy.
Scope
The testing team reviewed the provided C++ source
code as well as the design documents. The QML
files that are used for UI layout were deemed out
of scope. Ricochet relies upon Tor and Tor hidden
services but Tor itself was not included in scope.
Cursory dynamic analysis of Ricochet was performed
butadditionaltestingisrecommended. AFL1wasused
to fuzz the application, and several simple utilities for
fuzzing Ricochet with AFL are provided in Appendix B
onpage20:
• AsimpleclientwritteninPythonusedtofeedtheAFL-
generatedinputsintotheapplication.
• AseriesofsmallmodificationstoRicochettofacilitate
fuzzingviaAFL.
• AsmallCshimtolaunchthePythonclient,andthen
execve()toRicochet.
1http://lcamtuf.coredump.cx/afl/
3|RicochetSecurityAssessment
Project Dashboard
TargetMetadata EngagementData
Name RicochetSecurityAudit Type SourceCodeReview
Type AnonymousInstantMessenger Method WhiteBox
Platforms C++,QT,Protobuf Dates 2015-11-16to2015-11-22
Consultants 2
Levelof
effort 16person-days
VulnerabilityBreakdown
CriticalRiskissues 0
HighRiskissues 1
MediumRiskissues 1
LowRiskissues 0
Informationalissues 6
Totalissues 8
CategoryBreakdown
Cryptography 3
DataExposure 2
DataValidation 3
Key
Critical High Medium Low Informational
4|RicochetSecurityAssessment
Best Practices Evaluation
Ricochet'ssecurityposturewasevaluatedinseveralkeyareas. Overall,Ricochetwasfoundtobeastrongapplication
thatmetbestpracticesforaprivacy-focusedC++program. However,severalareaswereidentifiedinwhichimprove-
mentscouldgreatlyenhancethesecurityofRicochet.
RatingExplanation
• Satisfactory: Meetsorexceedsindustrybestpractice
• Fair: Maynotbeintotalcompliancewithbestpractices,butnodirectlyactionableissueswereidentified
• Needsimprovement: Failstocomplywithbestpractices,andcontainsactionableflawsinthisarea
Asdesigned: Asimplemented:
InputValidation Fair Needsimprovement
BestPractice: Afamousdictuminsecurityis``anythingthattakesuserinputcanbehacked''. Whileabithyperbolic,
processinginputfromusersisthemostcommonareainwhichsecurityvulnerabilitiesarefound.
Sources of user input should be identified, and validated according to the context of the input. Various strategies
forvalidationinclude: logicchecks,sanitization,whitelisting,andoutput-encoding. Whichstrategiesareappropriate
dependsonthecontextoftheinput.
Evaluation: Ricochet'sinputvalidationvariesgreatlydependingonwhatlayerisbeingexamined:
• Attheprotocollayer,thereareanumberofcheckstoensurethatincomingmessagesareproperlysized,andare
validaccordingtotheprotocolstatemachine. Theseincludestrongdefensiveprogrammingtechniques,suchas
ensuringthataconnection'schannelistheexpectedvalue.
• Attheapplicationlayer,inputvalidationislacking. VulnerabilitiessuchasfindingNCC-RicochetSecurityAudit-007
onpage10orfindingNCC-RicochetSecurityAudit-006onpage11maycompromisetheprivacyofauser,dueto
insufficientvalidationofthecontentsofmessages.
Recommendation:
• Attheprotocollayer,continueusingdefensiveprogrammingtechniques,suchascheckingthatanyprotocol-level
statechangesareallowed,incomingrequestsarewell-formed,incomingmessagesareonthecorrectchannel,in-
comingrequestsonachannelareonthecorrectconnection,andsoforth.Particularcareshouldbetakenwhenever
achangetotheunderlyingconnectionobjectforachannelismade(thisisdoneveryrarely),asamistakeherecould
leadtomessagesgoingtoadifferentparty.
• Attheapplicationlayer,applystrictvalidationtoalluserinput. Again,defensiveprogrammingcanbeusedhere,
bycombiningawhitelistapproachofallowableinputwithcontext-appropriateencodingofpotentiallydangerous
charactersbeforetheyareused. Formoreinformation,seefindingNCC-RicochetSecurityAudit-007onpage10
andfindingNCC-RicochetSecurityAudit-006onpage11.
5|RicochetSecurityAssessment
Asdesigned: Asimplemented:
Cryptography Needsimprovement Fair
BestPractice: Cryptographyisoneoftheeasiestelementstogetwronginsecurity. Verysmallmistakesinanimple-
mentationcanleadtoexploitableflawsthatallowcompromiseofauthenticity,anonymityorconfidentiality.
Becauseofthisaccepteddifficulty,itishighlyrecommendedtousestandardimplementationsofcryptographictech-
niques, especially those that have been extensively audited by the cryptography community. In addition, protocol
designshouldaimtoeliminatecryptographiccomplexity,asitiseasytocombinewhatareotherwisesecureprimitives
inaninsecureway.
BecauseRicochetismeanttobeamessagingserviceforthosewhoneedanonymity,itsthreatmodelshouldinclude
state-level adversaries, who may have cryptanalytic techniques beyond even what is publicly known. As such, it is
highlyrecommendedtousethemostup-to-dateencryptionschemes,andlayerencryptionwhenthatisnotpossible.
Inaddition,state-leveladversariesmayhavetheabilitytoobtainphysicalaccesstothemachine,socareshouldbe
takentoprotectdataatrestusingcryptography.
Evaluation: Ricochet provides transport layer security using Tor's hidden services.2 While these do provide crypto-
graphic protection (including perfect forward secrecy), several of the cryptographic primitives they are built on are
no longer considered strong. Ricochet uses a protocol for authenticating the client to the server that introduces
unnecessarycryptographiccomplexity. Inaddition,noencryptionispresentondataatrest.
Recommendation: Ricochetshouldtakeseveralstepstoimproveitscryptographicsecurity:
• Reworkthehost-verification,asdetailedinfindingNCC-RicochetSecurityAudit-001onpage12andfindingNCC-
RicochetSecurityAudit-003onpage14.
• Addapplication-layercryptography,asdetailedinfindingNCC-RicochetSecurityAudit-004onpage15.
• Encryptsensitivedataatrest,asdetailedinfindingNCC-RicochetSecurityAudit-005onpage17.
Inaddition,itwouldbebeneficialforRicochettoimplementChannelBindingwiththehiddenservicelink-layeren-
cryption. By binding Ricochet's key exchange to the underlying transport, one can be assured that both parties of
theconnectionarecommunicatingonthesameencryptedconnectionandfurthermitigateforwardingorman-in-the-
middleattacks.Inordertodothis,Torwouldneedtoaddsupportforchannelb