Penetration Test Report (SECConsult): ProtonVPN Windows app audit report 2020

Report 1907974
Source Code Review
ProtonVPN Windows App
for
Proton Technologies AG
conducted by
SEC Consult
Version: 1.2 | Date: 2019-11-15
Responsible: SEC Consult | Author: SEC Consult
Confidentiality class: Public
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
Table of Contents
Table of Contents ........................................................................................................................ 2
1 Management Summary ......................................................................................................... 3
1.1 Scope and Timetable ............................................................................................................ 3
1.2 Results ................................................................................................................................ 4
1.3 Disclaimer ............................................................................................................................ 4
2 Vulnerability Summary .......................................................................................................... 5
2.1 Total Risk Per System ........................................................................................................... 5
2.2 Risk of Each Vulnerability ...................................................................................................... 6
3 Detailed Analysis .................................................................................................................. 7
3.1 ProtonVPN Windows App ...................................................................................................... 7
3.1.1 General Information ....................................................................................................... 7
3.1.2 Sensitive Data in Memory - ACCEPTED .......................................................................... 7
3.1.3 Hardcoded Credentials - ACCEPTED .............................................................................. 8
3.1.4 Debug Messages Enabled - FIXED ................................................................................. 9
3.1.5 OpenVPN UDP Listener on All Interfaces - FIXED.......................................................... 10
4 Version History ................................................................................................................... 11
SEC Consult office@sec-consult.com | www.sec-consult.com Page 2 of 11
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
1 Management Summary
The following chapter summarizes the scope and timetable of the code review, the results of the code
review, and outlines the measures recommended by SEC Consult.
1.1 Scope and Timetable
During the initial security assessment for Proton Technologies AG, SEC Consult performed a source code
review of the ProtonVPN client for Windows - a VPN app for desktops running Windows, which offers
private and secure passing of user traffic through Secure Core network in privacy-friendly countries like
Switzerland and Iceland. Objective of the review was to reveal security issues and to offer suggestions for
improvement. The focus of the code review was to provide answers to the following questions:
- Does the ProtonVPN solution ensure the privacy of the user?
- Is an attacker able to access data of other customers (cross-tenant access)?
- Is an attacker able to use paid ProtonVPN features without an account upgrade?
The initial review was conducted in Q1 2019 and a total effort of 6 days was dedicated to identifying and
documenting security issues in the code base of the ProtonVPN Windows App.
Version 1.10.2 of the application was tested. Full access to the source code was granted and test user
credentials of the roles “free”, “plus”, “professional”, and “visionary” were provided.
The following files and documents were made available in the course of the review:
Files SHA1 Sum
ProtonVPN.config 4376270dad7c01c9bab[PII_REDACTED]e2bd3c37389
README.md 4080a4817f7070152b01958bad0eb3a7a4d70190
Win-client.zip eac6a053c0a3eb0b75d4e594abd1e1c3afd506df
In September 2019, Proton Technologies AG fixed the identified issues and supplied the fixes to SEC
Consult for verification. Goal of the fix verification was to confirm remediation provided by the applied fixes.
SEC Consult verified the fixes in October 2019.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 3 of 11
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
1.2 Results
During the initial code review, SEC Consult found two medium-risk vulnerabilities and two low-risk
vulnerabilities in the reviewed source code and the app. However, it was not possible to decrypt encrypted
VPN traffic.
No issues were identified, which would provide an attacker unauthorized access to other customers’ data
without having physical access to the victim’s desktop. An attacker with physical access to a victim’s
desktop can obtain user-related information either from debug routines (excessive debug messages contain
various user-related information that can be easily accessed by an attacker), or from memory dump of the
application.
All security issues that were identified in the initial code review were properly fixed or accepted
by Proton Technologies AG.
1.3 Disclaimer
At the request of Proton Technology AG, this report has been declassified from strictly confidential to public.
While the report was shortened for public release, relevant vulnerability information has been maintained.
In this particular project, a timebox approach was used to define the consulting effort. This means that SEC
Consult allotted a prearranged amount of time to identify and document vulnerabilities. Because of this,
there is no guarantee that the project has discovered all possible vulnerabilities and risks.
Furthermore, the security check is only an immediate evaluation of the situation at the time the check was
performed. An evaluation of future security levels or possible future risks or vulnerabilities may not be
derived from it.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 4 of 11
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
2 Vulnerability Summary
This chapter contains all identified vulnerabilities in the reviewed source code of the company Proton
Technologies AG.
Initial no. of Current no. of
Risk assessment
vulnerability classes vulnerability classes
Low 2 0
Medium 2 0
High 0 0
Critical 0 0
Total 4 0
2.1 Total Risk Per System
The following table contains a risk assessment for each system which contained security flaws.
System Field of application Initial risk Current risk
ProtonVPN Windows App Desktop Medium -
Total - Medium -
SEC Consult office@sec-consult.com | www.sec-consult.com Page 5 of 11
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
2.2 Risk of Each Vulnerability
The following table contains a risk assessment for the discovered vulnerabilities.
Vulnerability System Initial risk Current risk Page
Sensitive Data in Memory ProtonVPN Windows App Medium ACCEPTED 7
Hardcoded Credentials ProtonVPN Windows App Medium ACCEPTED 8
Debug Messages Enabled ProtonVPN Windows App Low FIXED 9
OpenVPN UDP Listener on
ProtonVPN Windows App Low FIXED 10
All Interfaces
Total - Medium - -
SEC Consult office@sec-consult.com | www.sec-consult.com Page 6 of 11
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Windows App
Responsible: SEC