Penetration Test Report (Cure53): Cure53 1PW18 report

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report 1Password Core 11.-12.2021
Cure53, Dr.-Ing. M. Heiderich, MSc. S. Moritz, MSc. F. Fäßler
Index
Introduction
Scope
Identified Vulnerabilities
1PW-18-003 WP2: Windows malware can trivially backdoor .html and .js (High)
1PW-18-006 WP2: Malware can trivially intercept URL handler (Medium)
Miscellaneous Issues
1PW-18-001 WP1: Insufficient validation of emails in onepassword URL (Info)
1PW-18-002 WP1: Missing deprovisioning of TPM enclave key (Low)
1PW-18-004 WP2: DoS for update via Windows registry deletion (Low)
1PW-18-005 WP1: Outdated Electron version used (Info)
Conclusions
Introduction
“Millions of customers and more than 100,000 businesses trust 1Password to keep their
most important information safe. At 1Password we believe everyone deserves to be safe
online. That's why we're building modern, accessible apps with privacy and security at
their core.”
From https://1password.com/company/
This report describes the results of a security assessment of the 1Password complex,
particularly the 1Password core code and software. Carried out by Cure53 in late
November and early December 2021, the project included a penetration test and a
dedicated audit of the source code.
Registered as 1PW-18, the project was requested by 1Password in early 2021 as part of
the annual penetration testing plan. It was scheduled for the last quarter of 2021 to allow
ample time for preparations on both sides. The project is the latest of a total of eighteen
testing iterations that took place, explaining the test label 1PW-18.
Cure53, Berlin · 02/03/22 1/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
As for the precise timeline and specific resources, Cure53 completed the examination as
scheduled, in CW47 and CW48. A total of fourteen days were invested to reach the
coverage expected for this assignment, whereas a team of three senior testers has been
composed and tasked with this project’s preparation, execution and finalization. All
members of the testing team were already familiar with the 1Password software
compound via previous project work.
For optimal structuring and tracking of tasks, the work was split into two separate work
packages (WPs):
• WP1: 1Password core codebase & software, written predominantly in Rust
• WP2: High-level research questions asked by the 1Password Team
As mentioned, this test and audit is part of the yearly penetration testing and code
auditing routine executed by Cure53 against several elements of the 1Password
software compound. In this test iteration, it was planned to look at builds for several
platforms, but, ultimately, the scope was changed because not all items planned for this
testing round were fully ready for testing. In the end, the following areas were covered:
• Key focus on the new Windows Hello feature and
• Key focus on the Browser + CLI integration on Linux
• High-level questions regarding macOS client
Cure53 was, as usual for engagements between 1Password and Cure53 given access
to a very detailed scope document explaining all areas of interest and access
parameters. This was provided alongside sources, binaries, documentation and
everything else that was needed. The above indicates that white-box methodology was
the approach of choice for this project.
The project progressed effectively on the whole. All preparations were done in CW46 to
foster a smooth transition into the testing phase. As usual, preparatory work on the
1Password team’s side was exceptionally good. Over the course of the engagement, the
communications were done using a private, dedicated and shared Slack channel set up
between the respective workspaces of Cure53 and 1Password. New channel was set up
and all involved personnel could join the discussions.
The discussions throughout the test were very good and productive and not many
questions had to be asked. The scope was well-prepared and clear, greatly contributing
to the fact that no noteworthy roadblocks were encountered during the test. It has to be
stated that the 1Password team, as in other tests before, was very helpful and did
whatever was necessary to make it possible for Cure53 to get good coverage over the
Cure53, Berlin · 02/03/22 2/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
scope with the chosen approaches. The assistance spanned fast answers to all
questions, very quick turnaround times and generally excellent test-support. Ongoing
interactions positively contributed to the overall outcomes of this project.
Cure53 offered frequent status updates about the test and the emerging findings. Live-
reporting was done for several of the findings to allow the 1Password team an early
review of the issues and more time to ask questions about the possible fixes to be
developed and deployed.
The Cure53 team managed to get very good coverage over the WP1-WP2 scope items.
Among five security-relevant discoveries, two were classified to be security
vulnerabilities and three to be general weaknesses with lower exploitation potential. It
can be deduced that the results of this project put 1Password in a very positive light. The
number of issues is small and only one item was marked as High. Cure53 strongly
believes that frequent testing contributes to 1Password maturing and being in a good
state. Two of the findings assume malware to be in place to function, whereas others are
rather limited in terms of actual risks. Note that one of those findings, see 1PW-18-003,
is quite similar to an issue reported several months ago as 1PW-10-010, so it could have
potentially been avoided.
In the following sections, the report will first shed light on the scope and key test
parameters, as well as the structure and content of the WPs. Next, all findings will be
discussed in grouped vulnerability and miscellaneous categories, then following a
chronological order in each group. Alongside technical descriptions, PoC and mitigation
advice are supplied when applicable. Finally, the report will close with broader
conclusions about this late 2021 project. Cure53 elaborates on the general impressions
and reiterates the verdict based on the testing team’s observations and collected
evidence. Tailored hardening recommendations for the 1Password complex are also
incorporated into the final section.
Cure53, Berlin · 02/03/22 3/14
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration tests and code audits against 1Password core code & software
◦ WP1: 1Password Core codebase & software, written predominantly in Rust
▪ In scope were builds for several platforms and their general security properties.
▪ Key features in scope for this assignment:
• Newly implemented Windows Hello feature
• Improvements of Browser Integration feature on Linux
• Newly added integration with CLI
◦ WP2: High-level research questions asked by the 1Password team
▪ Q1: "In what way do we not protect well against system processes running with
the same privileges as the current user?"
▪ Q2: "Can same-user privilege processes perform successful active attacks
against the desktop apps?"
▪ Q3: "Can same-user privilege processes learn anything about vault contents of
the desktop application when it’s locked?"
▪ Q4: "In what way can we reasonably improve our resilience against attacks that
use administrative privileges?"
▪ Q5: "Does our application contain exploitable desktop/electron based
vulnerabilities, potentially those that can be leveraged by shared vaults?"
▪ Q6: "Is browser communication something that can be hijacked?"
• Test-user-accounts
◦ Account 1:
▪ https://seba-1pw18.b5test.com /
▪ U: seba@cure53.de
◦ Account 2:
▪ https://fabian1pw18.b5test.com /
▪ U: fabian @cure53.de
• All relevant binaries have been shared with Cure53:
• Detailed test-supporting material has been shared with Cu