Penetration Test Report (SECConsult): ProtonVPN Android app audit report 2020

Report 1907974
Source Code Review
ProtonVPN Android App
for
Proton Technologies AG
conducted by
SEC Consult
Version: 1.2 | Date: 2019-11-15
Responsible: SEC Consult | Author: SEC Consult
Confidentiality class: Public
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Android App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
Table of Contents
Table of Contents ........................................................................................................................ 2
1 Management Summary ......................................................................................................... 3
1.1 Scope and Timetable ............................................................................................................ 3
1.2 Results ................................................................................................................................ 4
1.3 Disclaimer ............................................................................................................................ 4
2 Vulnerability Summary .......................................................................................................... 5
2.1 Total Risk Per System ........................................................................................................... 5
2.2 Risk of Each Vulnerability ...................................................................................................... 6
3 Detailed Analysis .................................................................................................................. 7
3.1 ProtonVPN Android App ........................................................................................................ 7
3.1.1 General Information ....................................................................................................... 7
3.1.2 Insecure Logout - FIXED ................................................................................................ 7
3.1.3 Debug Messages Enabled - ACCEPTED ......................................................................... 8
3.1.4 Application Data Backup via ADB Enabled - FIXED .......................................................... 9
3.1.5 Hardcoded Credentials / Imperfect Data Encryption - ACCEPTED .................................. 10
3.1.6 Missing Certificate Pinning - FIXED ............................................................................... 11
4 Version History ................................................................................................................... 12
SEC Consult office@sec-consult.com | www.sec-consult.com Page 2 of 12
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Android App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
1 Management Summary
The following chapter summarizes the scope and timetable of the code review, the results of the code
review, and outlines the measures recommended by SEC Consult.
1.1 Scope and Timetable
During the initial security assessment for Proton Technologies AG, SEC Consult performed a source code
review of the ProtonVPN client for Android - a VPN app for Android devices, which offers private and secure
passing of user traffic through Secure Core network in privacy-friendly countries like Switzerland and
Iceland. Objective of the review was to reveal security issues and to offer suggestions for improvement.
The focus of the code review was to provide answers to the following questions:
- Does the ProtonVPN solution ensure the privacy of the user?
- Is an attacker able to access data of other customers (cross-tenant access)?
- Is an attacker able to use paid ProtonVPN features without an account upgrade?
The initial review was conducted in Q1 2019 and a total effort of 6 days was dedicated to identifying and
documenting security issues in the code base of the ProtonVPN Android App.
Version 2.0.4 of the application was tested. Full access to the source code was granted and test user
credentials of the roles “free”, “plus”, “professional”, and “visionary” were provided.
The following files and documents were made available in the course of the review:
Files SHA1 Sum
android-app-development.zip 2a01b63a37b335cf4d1e37b5a87dab866eb6b545
ProtonVPN-2.0.4(102)-prod-release.apk 3569c15655bae5b25c27d088613d38ca08ffeb35
Readme.md 368dbfbf2ed0e66426af14d5941ba45001ebfdf0
In September 2019, Proton Technologies AG fixed the identified issues and supplied the fixes to SEC
Consult for verification. Goal of the fix verification was to confirm remediation provided by the applied fixes.
SEC Consult verified the fixes in October 2019.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 3 of 12
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Android App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
1.2 Results
During the initial code review, SEC Consult found one medium-risk vulnerability and four low-risk
vulnerabilities in the reviewed source code and the mobile app.
Although issues with certificate validation have been identified within the encrypted communication
between the mobile application and the backend system, encrypted VPN traffic could not be decrypted.
No issues were identified, which would provide an attacker unauthorized access to other customers’ data
without having physical access to the victim’s device. An attacker with physical access to a mobile device
can obtain user-related information from debug routines, as excessive debug messages contain various
user-related information that can be easily accessed by an attacker.
All security issues that were identified in the initial code review were properly fixed or accepted
by Proton Technologies AG.
1.3 Disclaimer
At the request of Proton Technology AG, this report has been declassified from strictly confidential to public.
While the report was shortened for public release, relevant vulnerability information has been maintained.
In this particular project, a timebox approach was used to define the consulting effort. This means that SEC
Consult allotted a prearranged amount of time to identify and document vulnerabilities. Because of this,
there is no guarantee that the project has discovered all possible vulnerabilities and risks.
Furthermore, the security check is only an immediate evaluation of the situation at the time the check was
performed. An evaluation of future security levels or possible future risks or vulnerabilities may not be
derived from it.
SEC Consult office@sec-consult.com | www.sec-consult.com Page 4 of 12
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Android App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
2 Vulnerability Summary
This chapter contains all identified vulnerabilities in the reviewed source code of the company Proton
Technologies AG.
Initial no. of Current no. of
Risk assessment
vulnerability classes vulnerability classes
Low 4 0
Medium 1 0
High 0 0
Critical 0 0
Total 5 0
2.1 Total Risk Per System
The following table contains a risk assessment for each system which contained security flaws.
System Field of application Initial risk Current risk
ProtonVPN Android App Mobile Medium -
Total - Medium -
SEC Consult office@sec-consult.com | www.sec-consult.com Page 5 of 12
Report 1907974 for Proton Technologies AG
Source Code Review – ProtonVPN Android App
Responsible: SEC Consult
Version/Date: 1.2 / 2019-11-15
Confidentiality class: Public
2.2 Risk of Each Vulnerability
The following table contains a risk assessment for the discovered vulnerabilities.
Vulnerability System Initial risk Current risk Page
Insecure Logout ProtonVPN Android App Medium FIXED 7
Debug Messages Enabled ProtonVPN Android App Low ACCEPTED 8
Application Data Backup
ProtonVPN Android App Low FIXED 9
via ADB Enabled
Hardcoded Credentials /
P