Penetration Test Report (TrailOfBits): MagmaWallet

Tezos Crypto Wallets
Security Assessment
June 8, 2020
Prepared For:
Tezos Foundation
security@tezos.com
Prepared By:
Artur Cygan | T​ rail of Bits
artur.cygan@trailofbits.com
Changelog:
July 30, 2020: Added new iOS and Android findings
September 10, 2020:Initial fix review
September 21, 2020: Additional fix review
September 29, 2020: Additional fix review
September 29, 2020:Final report for publication
Executive Summary
Project Dashboard
Engagement Goals
Coverage
Recommendations Summary
Short Term
Long Term
App Findings
1. Mnemonic is copied to clipboard
2. Mnemonic stays in memory for too long
3. Keychain security level is not the strongest available
4. Keychain operations are not checked for errors
5. Recovery phrase is displayed without a timeout
6. PIN code is sometimes not requested
7. Wallet can be imported from more than 12 words
8. Too much code mocked
9. Sometimes all exception types are handled
10. encryptWithSalt uses weaker hashing on exception
11. generateMnemonic function delays error handling
12. Wallet structure permits inconsistent state
13. Server lacks OCSP stapling
14. Sensitive information exposed to 3rd Party SDK (Sentry)
15. Multiple servers support weak TLS protocols and ciphers
16. Servers do not restrict access over HTTP
iOS Platform Findings
17. Application data remains exposed after first unlock
18. Disable third-party keyboards
19. TLS certificates are not pinned for multiple domains
20. Sensitive data is archived in iCloud and iTunes backups
21. iOS pasteboard data does not have an expiration date
Android Findings
22. App does not restrict the use of unencrypted HTTP
23. Enable verification of Android Security Provider
24. Enable Android Verify Apps
25. App Views are Vulnerable to TapJacking
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 1
26. Enable SafetyNet Attestation API
27. App susceptible to App Links hijacking
A. Vulnerability Classifications
B. Android Heap Dump
C. Non–Security-Related Findings
G. Fix Log
Detailed Fix Log
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 2
Executive Summary
From June 1 through June 5, 2020, Tezos Foundation engaged Trail of Bits to review the
security of the Magma Wallet. Trail of Bits conducted this assessment over the course of
one person-week with one engineer working from:
● 4b5e84d[PII_REDACTED][PII_REDACTED]7fd0debd7b7b0​ from the k​ otlin-tezos repository
​
● 539c8459964b2e78dfd451aa777498510d03efc3 ​from the ​magmawallet-android
repository
● 48c9ca512e95ac0a51a8a2cf9443b96b5629f505 ​from the ​magmawallet-ios
repository
We performed manual review of the provided code around the most critical spots, and
verified that both wallets could be built and run on simulators. We also took a closer look at
the user interface.
In the course of our review, we found one high-, eleven medium-, thirteen low-, and four
informational-severity findings. The high-severity issue is the copy mnemonic to clipboard
feature which can cause it to be stolen by a malicious application or to be leaked
accidentally by one of popular applications which automatically read the system clipboard
content. Most of the medium-severity findings also concern security of the mnemonic
indicating places where the wallet could be improved to reduce the possibility for an
exposure. The remaining minor issues revolve around testing methodology, imprecise
error handling, cryptography, and data validation.
Both the Android and iOS wallets are lacking when it comes to their current level of
security, considering the importance of the secrets they store. The codebases are under
active development which includes occasional work-in-progress or commented-out code.
The Android wallet’s code is slightly better in terms of quality than that of the iOS wallet.
Imprecise error handling and data validation are systemic issues that don’t pose an
immediate threat, but might manifest as a number of security issues in the future.
Overall, we recommend rethinking the user interface to favor security over convenience.
Minimizing secrets’ lifetimes will require some attention and debugging. The remaining
minor issues can be fixed with simple code changes, and adopting our long-term
recommendations will help prevent them in the future.
Update: On September 10, 2020, Trail of Bits reviewed fixes implemented for the issues
presented in this report—see details in ​Appendix G.​
Update: On September 21, 2020, Trail of Bits discussed the previously reviewed solution to
finding #14 ​with Tezos and, upon further research, the finding was determined to be resolved.
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 3
Update: On September 29, 2020, Trail of Bits updated ​finding #2 ​after discussing code updates
contained in commits that were part of the previously reviewed Pull Requests.
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 4
Project Dashboard
Application Summary
Name Magma Wallet
Version kotlin-tezos:
​
4b5e84d[PII_REDACTED][PII_REDACTED]7fd0debd7b7b0
magmawallet-android:
​
539c8459964b2e78dfd451aa777498510d03efc3
magmawallet-ios:
​
48c9ca512e95ac0a51a8a2cf9443b96b5629f505
Type Kotlin, Java, Swift
Platforms iOS, Android
Engagement Summary
Dates June 1 through June 5, 2020
Method Whitebox
Consultants Engaged 1
Level of Effort 1 person-week
Vulnerability Summary
Total High-Severity Issues 1 ◼
Total Medium-Severity Issues 11 ◼◼◼◼◼◼◼◼◼◼◼
Total Low-Severity Issues 11 ◼◼◼◼◼◼◼◼◼◼​◼
Total Informational-Severity Issues 4 ◼◼◼◼
Total 27
Category Breakdown
Access Controls 2 ◼◼
Authentication 2 ◼◼
Configuration 2 ◼◼
Cryptography 7 ◼◼◼◼◼◼◼
Data Exposure 8 ◼◼◼◼◼◼◼◼
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 5
Data Validation 2 ◼◼
Error Reporting 3 ◼◼◼
Testing 1 ◼
Total 27
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 6
Engagement Goals
The engagement was scoped to provide a security assessment of the Android wallet,
Android SDK, and the iOS wallet.
Specifically, we sought to answer the following questions:
● Is the wallet securely stored?
● Is it possible for an adversary to execute unauthorized actions?
● Is calling external APIs safe?
● Is error handling implemented correctly?
Coverage
Key management and storage. ​Manually reviewed with the help of automated static
analysis using Data Theorem and debugging tools.
User interface. M​ anually reviewed with the help of automated static analysis using Data
Theorem.
Cryptography. ​Manually reviewed with the help of automated static analysis using Data
Theorem.
Communication with APIs. ​Manually reviewed with the help of automated static analysis
using Data Theorem.
© 2020 Trail of Bits Tezos Magma Wallet Assessment | 7
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Short Term
❑ Don’t allow the mnemonic to be copied to the clipboard.​ Ensure users store the
phrase by requiring them to retype it in a following view during onboarding. ​TOB-TZWL-001
❑ Fetch the mnemonic from the keychain only when absolutely needed, e.g., right
before signing or when displaying it in settings. ​Clear out sensitive information from
memory when it is no longer needed. T​ OB-TZWL-002
❑ Implement the highest security level for keychain items, especially for the
mnemonic.​ Pass the security level explicitly to the KeychainSwift library. T​ OB-TZWL-003
❑ Check keychain error codes and handle them appropriately. ​Unhandled errors may
leave keys in the keychain unintentionally.​ ​TOB-TZWL-004
❑ Add a timeout to the recovery phrase view that exits the view or hides the secret.
Users may leave their device unattended and expose the keyphrase unintentionally.
TOB-TZWL-005
❑ Ensure the PIN code is requested. O​ nce set, the wallet should never be accessible
without the PIN code.​ ​TOB-TZWL-006
❑ Validate the number of words a user provides. ​Either lock the system to 12-word
mnemonics only, or fully support a va