All your family secrets belong to us - Worrisome security issues in - PowerPoint PPT Presentation

Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary 47

Mitm Attack DATA DATA tracking provider (back-end/cloud) user/app 48

Mitm Attack DATA DATA tracking provider (back-end/cloud) user/app 49

Mitm Attack DATA DATA tracking provider (back-end/cloud) user/app 50

Mitm Attack DATA DATA tracking provider (back-end/cloud) user/app 51

Mitm + Bad Crypto + Obfuscation ?? 52

Mitm + Bad Crypto + Obfuscation ?? user@example.com secure123 53

Mitm + Bad Crypto + Obfuscation http ://s9.***********.com/login/?aaa... GET /login/?aaa=Bi9srqo&nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 54

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 user@example.com secure123 55

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com secure123 56

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 57

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 58

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 59

Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 60

Mitm + Bad Crypto + Obfuscation 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' 61

Mitm + Bad Crypto + Obfuscation @ user@example.com 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' XOR Base64 DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== 62

Mitm + Bad Crypto + Obfuscation @ user@example.com 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' XOR {nl, bhf, mag, bdt, qac, trn, amr, mix, nch} + “=“ + Random() Base64 nch = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A mix = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A amr = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A mag = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A 63

Mitm + Bad Crypto + Obfuscation @ ******** secure123 user@example.com 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' XOR XOR {df, ssp, fgh, drt, tnd, rfb, rma, vwe, hac} {nl, bhf, mag, bdt, qac, trn, amr, mix, nch} + “=“ Base64 + + + Random() Random() Base64 “=“ nch = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A CFF1CxQoaQcoLWoRaQ%3D%3D%0A = tnd mix = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A CFF1CxQoaQcoLWoRaQ%3D%3D%0A = ssp amr = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A CFF1CxQoaQcoLWoRaQ%3D%3D%0A = rma mag = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A CFF1CxQoaQcoLWoRaQ%3D%3D%0A = df 64

Mitm + Bad Crypto + Obfuscation decode Base64 decode Base64 DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== CFF1CxQoaQcoLWoRaQ== 65

Mitm + Bad Crypto + Obfuscation @ ******** secure123 user@example.com 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' XOR XOR decode Base64 decode Base64 DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== CFF1CxQoaQcoLWoRaQ== 66

Mitm + Bad Crypto + Obfuscation GET /login/? @ aaa =Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A ******** data =5JFJzgYW_ HTTP/1.1 + “=“ + GenerateRandomString() Random() {usr, psw, uid, data, eml, pss, foo, clmn, count, nam, srv, answ, aaa } 67

68

Correct Secure Communication § Use https via TLS 1.2 or TLS 1.3 § Valid server certificate 69

Correct Secure Communication § Use https via TLS 1.2 or TLS 1.3 § Valid server certificate § Implementation in Android: Kotlin: Java: URL url = new URL(" https ://wikipedia.org"); val url = URL(" https ://wikipedia.org") URLConnection urlConnection = url.openConnection(); val urlConnection: URLConnection = url.openConnection() https://developer.android.com/training/articles/security-ssl#java 70

“Authentication“ 71

“Authentication“ … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection( ); try { … 72

“Authentication“ … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection(" jdbc:mysql://mysql.r*****************r.mobi/r*************06 ", "r*************06" , " t**********b "); try { … 73

“Authentication“ … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection(" jdbc:mysql://mysql.r*****************r.mobi/r*************06 ", "r*************06" , " t**********b "); try { … database address username 74

“Authentication“ … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection(" jdbc:mysql://mysql.r*****************r.mobi/r*************06 ", "r*************06" , " t**********b "); try { … database address username password 75

“Authentication“ § MySQL Database with following table scheme: Field Type Null Key Default Extra nome varchar(50) NO NULL email varchar(30) NO NULL latitude varchar(30) NO NULL longitude varchar(30) NO NULL data varchar(30) NO NULL hora varchar(30) NO NULL codrenavam varchar(30) NO NULL placa Varchar(30) NO PRI NULL 76

“Authentication“ … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection(" jdbc:mysql://mysql.r*****************r.mobi/r*************06 ", "r*************06" , " t**********b "); try { … database address username password All in all we had access to over 860.000 location data of different users, distributed over the whole world. 77

Is that all ? 78

Prepared Statement? WTF! … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)"); 79

Prepared Statement? WTF! … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)"); prest.executeUpdate(" insert into rastreadorpessoal values ('" + this.atributos.getNome() + "', '" + this.atributos.getEmail() + "', '" + this.atributos.getLatitudeStr() + "', '" + this.atributos.getLongitudeStr() + "', '" + this.atributos.getDataBancoStr() + "', '" + this.atributos.getHoraBancoStr() + "', '" + this.atributos.getRenavam() + "', '" + this.atributos.getPlaca() + "')"); prest.close(); con.close(); … 80

Prepared Statement? WTF! … Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)"); prest.executeUpdate(" insert into rastreadorpessoal values ('" + this.atributos.getNome() + "', '" + this.atributos.getEmail() + "', '" + this.atributos.getLatitudeStr() + "', '" + this.atributos.getLongitudeStr() + "', '" + this.atributos.getDataBancoStr() + "', '" + this.atributos.getHoraBancoStr() + "', '" + this.atributos.getRenavam() + "', '" + this.atributos.getPlaca() + "')"); prest.close(); con.close(); … 81

Stupid ! 82

Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary 83

101 1. Authentication Process 2. Authorization Process Observer 84

WTF-States of Server-Side Vulnerabilties 85

”That‘s a feature” 86

Not a Bug it‘s a Feature § Web service provides public access to user tracks, allow all by default 87

Not a Bug it‘s a Feature § Web service provides public access to user tracks, allow all by default 88

Not a Bug it‘s a Feature https://www.greenalp.com/realtimetracker/index.php?viewuser=USERNAME 89

Demo Time ! 90

Is that all ? 91

Public Webinterface 92

Authentication – What? 93

Part1: Who Needs Authentication? http ://***********g.azurewebsites.net/trackapplochistory.aspx? userid =********& childid =2***** ***0& currentdate =07/12/2017 94

Part1: Who Needs Authentication? nothing new http ://***********g.azurewebsites.net/trackapplochistory.aspx? userid =********& childid =2***** ***0& currentdate =07/12/2017 95

Part1: Who Needs Authentication? nothing new your user id http ://***********g.azurewebsites.net/trackapplochistory.aspx? userid =********& childid =2***** ***0& currentdate =07/12/2017 96

Part1: Who Needs Authentication? nothing new your user id http ://***********g.azurewebsites.net/trackapplochistory.aspx? userid =********& childid =2***** ***0& currentdate =07/12/2017 id of the person to track 97

Part1: Who Needs Authentication? nothing new your user id http ://***********g.azurewebsites.net/trackapplochistory.aspx? userid =********& childid =2***** ***0& currentdate =07/12/2017 id of the person to track requested date 98

Part1: Who Needs Authentication? Response for http://***********g.azurewebsites.net/... 07:47 PM*49.8715330929084,8.639047788304 attacker 07:52 PM*49.8731935027927,8.63498598738923 tracker back-end 07:53 PM*49.871533247265,8.63904788614738 … List of the complete track 99

Part1: Who Needs Authentication? 100