Penetration Test Report (Cure53): pentest report padlock

Pentest-Report Padlock.io 04.2016
Cure53, Dr.-Ing. M. Heiderich, Dipl.-Ings. A. Aranguren & A. Inführ, F. Fäßler, Filedescriptor
Index
Introduction
Scope
Identified Vulnerabilities
PIO -01-001 Android , iOS and Extension : Insecure PRNG usage ( Medium )
PIO -01-002 AP I : Emai l enumeration and unauthenticated rese t initiation ( Medium )
PIO -01-003 Android : Lack o f screen capture protections ( High )
PIO -01-005 Server : POODLE and DH key exchange weaknesses ( Medium )
PIO -01-006 Android and iOS : Lack o f Pinning ( Medium )
PIO -01-007 Activation link spoofing via Hos t header ( Low )
PIO -01-008 Android : Complete lack o f Tapjacking mitigations ( Medium )
PIO -01-009 Android , iOS and Extension : Permanen t sync DoS ( High )
PIO -01-010 iOS : Possible hijacking via unprotected files a t res t ( Medium )
PIO -01-011 AP I : Possible Denia l o f Service via replay ( High )
PIO -01-012 AP I : Emai l enumeration via invalid tokens ( Medium )
PIO -01-013 Android and iOS : User information stored in clear - tex t ( Medium )
PIO -01-014 Android and iOS : Use o f externa l clear - tex t H TTP U RL s ( Medium )
PIO -01-015 Android , iOS and Extension : XSS via innerHTML ( Info )
PIO -01-017 AP I : Possible vaul t takeover via activation ( High )
Miscellaneous Issues
PIO -01-004 AP I : No error check i f random fails ( Info )
PIO -01-016 Missing Password Manager Bes t Practices ( Info )
Conclusion
Introduction
“Passwords are everywhere. We need them to access our computers, our email
accounts and a ton of other services that we rely on. Unfortunately, passwords are a
poor way of authentication. Strong passwords are hard to remember and the sheer
number of different services makes it practically impossible to keep track of all of your
credentials. Most people try to mitigate this by composing their passwords out of familiar
things like names or birthdays, but these can be guessed easily and do not provide
sufficient protection. Password reuse, which is also wide-spread, is even more
dangerous and makes a lot of people easy targets for hackers. Password managers
help you keep track of your passwords by providing a secure storage that is protected
by a single master password. Good password managers keep your data safe by
encrypting it with a strong cipher like AES.”
From http :/ / padlock . io /
1/25
This report documents the findings of a penetration test and source code audit carried
out by the Cure53 team against the Padlock.io password manager application.
Performed in the first half of April 2016 over the course of eleven days, the assignment
involved five members of the Cure53 team.
The test’s scope encompassed the app’s Chrome extension, mobile applications and the
server API. Since the tasks were guided by the white-box approach, the Cure53 testers
had access to application sources. Github was used for sharing sources, as well as
functioned as a tool for facilitating communication exchanges between the Padlock’s
development team and the Cure53 testers. Throughout the test, dialogue with the
application maintainers was professional and productive, evidencing a commitment to
improving the state of security at the Padlock.io.
The test had yielded a total of seventeen security issues, fifteen classified as
vulnerabilities and two as general weaknesses. A particularly positive finding is that no
issues that could be described as “Critical” with regard to their severity and impact have
been found. Simultaneously, several issues marked as “High” paired with the rather
numerous diverse issues that pose security risks, need to be taken into account going
forward. In sum, the problems need to be quickly addressed and the recommendations
should be implemented as soon as possible.
Scope
• Chrome Browser Extension (Build shared)
◦ https :/ / github . com / MaKleSof t /padlock
• Mobile Apps (Built versions shared)
◦ https :/ / github . com / MaKleSof t / padlock - cordova
• Server API (Binary shared)
◦ https :/ / github . com / MaKleSof t / padlock - cloud
• All shared files are here
◦ https :/ / drive . google . com / drive / folders /0 B 3 mqh 4_ aOsKzQWtSdFdXYU 1 aRlU
2/25
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. PIO-01-001) for the purpose of facilitating any
future follow-up correspondence.
PIO-01-001 Android, iOS and Extension: Insecure PRNG usage (Medium)
It was found that the mobile apps and the Chrome extension make use of a
cryptographically insecure pseudo-random number generator (PRNG). An attacker could
leverage this weakness to predict previous and past randomly generated usernames
and passwords, as long as he has knowledge of a single randomly generated username
or password. This is the case because, given the current PRNG implementation, there
will be one randomly generated value per character of either a username or a password
in question. For example, a known generated password that is 10 characters in length
will provide the attacker with 10 sequential randomly generated values. From there, the
attacker should be able to brute-force the PRNG seed and calculate the full sequence of
the randomly generated values.
In file src/rand.js, the function randomItem() uses Math.random() to generate a random
character, which is then used as a component of a random username and password.
Since Math.random() is not cryptographically secure, an attacker can predict subsequent
random strings as long as they know one of the usernames or passwords generated
from it. What makes the implications of this issue worse, the JavaScript V8 engine in
Chromium was proven to employ a broken implementation1 of Math.random(), which
makes the task of brute-forcing it much easier.
To mitigate this problem, it is recommended to use the CSPRNG2 window.crypto.
getRandomValues() from Web Crypto API.
PIO-01-002 API: Email enumeration and unauthenticated reset initiation (Medium)
It was found that the API endpoint, normally intended for resetting passwords on the
cloud server, can be used to enumerate email addresses. If an email address does not
exist, the API will respond with a “User does not exist” error. This endpoint fails to require
the Authorization header for sending the reset email, which makes it easy to spam a
user with delete requests. In effect, one accidental click from a user could in fact delete
their password storage.
The following examples demonstrate this trivial issue:
1 https :// medium . com /@ betable / tifu - by - using - math - random - f 1 c 308 c 4 fd 9 d #.9 s 2 sddydi
2 https :// en . wikipedia . org / wik i / Cryptographically _ secure _ pseudorandom _ number _ generator
3/25
Example 1: Non-existing user
Request:
DELETE https://cloud.padlock.io/non-existent@cure53.de
Response:
HTTP/1.1 404 Not Found
User non-existent@cure53.de does not exists
Example 2: Existing user
Request:
DELETE https://cloud.padlock.io/fabian@cure53.de
Response:
HTTP/1.1 202 Accepted
It is recommended for the API to provide generic messages regardless of user
existence. In addition, sensitive user actions, such as deleting the password vault from
the cloud, should necessitate a server authentication.
Retest notes: The Cure53 team has verified a fix for this issue in the branch made
available by the maintainer for this pentest.
PIO-01-003 Android: Lack of screen capture protections (High)
It was found that the Android app does not currently implement screen capture
protections. In the latest Android versions this allows malicious apps with root privileges
to take screenshots or even full videos. This takes place in the background, running
without any user-interaction whatsoever. The ways in which malici