1. Introduction =============== * CIPHRON-ID: CIPH-2017-1 * Product: heinekingmedia StashCat * Status: Patch available * Affected versions: * Android: <= 1.7.5 * Web: <= 0.0.80w * Desktop <= 0.0.86 * Vendor-URL: https://www.stashcat.com/ * CVE: CVE-2017-11129 bis CVE-2017-11136 During an independent investigation researchers of CIPHRON found vulnerabilities in cryptographic and security functions of the instant menssenger StashCat of heinekingmedia GmbH. CIPHRON follows the principle of responsible disclosure and has informed heinekingmedia beforehand. heinekindmedia has reacted to the disclosure and has developed patches. These patches are available and will be distributed in successive. CIPHRON follows an own disclosure policy. This is available at https://ciphron.de/vulnerability-disclosure-policy 2. Description of software ========================== StashCat is developed by heinekingmedia GmbH and has the aim to give customers an instant messenger which encrypts the communication between clients End-to-End like it is known, for example, from WhatsApp or Telegram. It is worth mentioning that the messenger provides a web and a desktop client in addition to the Android and iOS app. According to heinekingmedia the messenger aims especially at the use by the police and authorities. More information are available at https://www.stashcat.com/ According to the web client website at https://app.stashcat.com we investigated version v0.0.80w The investigated Android versions were the versions 1.5.18 and 1.7.5. According to the installation file we investigated the version 0.0.86 of the desktop client. 3. Description of vulnerabilities ================================= The vulnerabilities were found during a half-day code review of the web client. This was possible because the client is written in angular and the client-side JavaScript code is directly available on https://app.stashcat.com The desktop client is build with Electron and is based on the web client code for the base functionality. We found vulnerabilities in the Android app via reverse engineering, too. The finding from the code review of the web client were verified through the reverse engineering if the protocol is affected. The vulnerabilities have assigned CVEs. These are CVE-2017-11129 to CVE-2017-11136. CIPHRON has asked an independent third party, the Niedersachsen-CERT (N-CERT), to verify the findings, what they did. We gave heinekingmedia the change to comment the findings. 3.1 Communication decryptable through vendor -------------------------------------------- CVE-2017-11136 One can see that the private key of the RSA-key pair, which is created on the clients and is used to exchange passwords for symmetric encryption of the communication channel, is transmitted to the StashCat-server. The password which is used to encrypt the private key are the first 32 bytes of the SHA512 hash of the user passsword. But this is transmitted to the vendor server, too, as it is the login password. This allows to decrypt the private key of StashCat users and therefore the formaly encrypted communication channel for everyone which has access to the vendor server because the password for the symmetric encryption can be eavesdropped. __Comment of heinekingmedia__ Passwords to secure the private key are now independent of the used account password. RSA keys are now 4096 bit in addition. 3.2 No key derivation function used ----------------------------------- CVE-2017-11131 Instead of using a key deriviation function to create the password for authentication, the user password is hashed directly with SHA512. Moreover, only the first 32 bytes are used. State-of-the-art is to use a key derivation function like PBKDF2 to generate from a source of low entropy a password with high entropy. Moreover, rainbow table attacks are mitigated through this __Comment of heinekingmedia__ RSA-keys are encrypted according to PKCS#8. PBKDF2 is used internally. 3.3 Passwords generated with math.random() ------------------------------------------ CVE-2017-11133 The communication ist encrypted with AES in CBC-mode. The passwords to encrypt the communication channel and the IV which are exchanged by the communicating parties with RSA-key pairs are generated with math.random. Newer versions are using CryptoJS.lib.WordArray.random() which uses math.random() internal as well. This method ist not secure in a cryptographic sense. Instead such generated passwords have to be treated as deterministic what could lead to a compromise of the communication channel. __Comment of heinekingmedia__ Channel and conversation secrets are are no longer generated by CryptoJS. 3.4 Integrity and authenticity not ensured ------------------------------------------ CVE-2017-11130 The integrity and authenticity of encrypted messages is not ensured. This allows, for example, replay attacks in man-in-the-middle scenarios. __Comment of heinekingmedia__ Responses created by the server are signed and can be verified by the public key of the server. 3.5 Logout without authorisation -------------------------------- CVE-2017-11135 Logouts of users can be done without authorisation because only the device ID is needed. __Comment of heinekingmedia__ The logout needs only the device_id. This is intentional and leads to the deletion of of data on the logouted device. This is by no means a vulnerability. __Remark of CIPHRON__ From our point of view this can lead to a problem if an attacker could enumerate all device IDs. This could be used for a denial of service attack. 3.6 Android-keystore uses hard coded password --------------------------------------------- CVE-2017-11129 The Android-keystore uses a hard coded password. This allows to read out contained passwords through third parties which gained access to the keystore. __Comment of heinekingmedia__ A hard coded password is not used from now on. The previously hard coded password for the Android-keystore is now replaced by a randomly generated password. The password is created by a random string of 32 characters which is generated by a secure random method. The random string is stored in the shared preferences of Android and is deleted with every logout. The stored random string is XORed with the manufacture and model code of the device. The result is used as the encryption key. From this the keystore password is derived in conjuncture with the device ID. 3.7 No certificate pinning -------------------------- CVE-2017-11132 The Android-app uses no certificate pinning. Instead, only the signature of the Certificate Authority is checked. This eases man-in-the-middle attacks. Remark: This finding was fixed independently of the disclosure process in Android-versions after 1.5.18. __Comment of heinekingmedia__ All apps use certificate pinning or HPKP to complicate man-in-the-middle attacks. 3.8 Login data in the logs -------------------------- CVE-2017-11134 The Android-app saves login data in the logs what could help attackers to gain access to this data. __Comment of heinekingmedia__ In the case of exceptions the request was saved to the log on the device. The log entries are now cleared beforehand. 4. Solution =========== heinekingmedia has accepted the findings and will distribute patches successively which are already available. 5. Credits ========== The code review and the reverse engineering was done by Karsten KAPnig of CIPHRON. Sebastian Horzela and Lennart Henke supported. The Niedersachen-CERT verified the findings of CIPHRON as an independent party. 6. Greets ========= Greets to the team of CIPHRON, especially Martin, Jan and Frithjof for the good discussions and the good atmosphere in the office. 7. Timeline =========== 10.03.2017 Vendor contacted 15.03.2017 Second contact attempt because no response received 15.03.2017 Phone call with heinekingmedia 15.03.2017 Findings communicated 06.06.2017 Note that findings are solved 28.06.2017 Communication of the prepared advisory for coordination 11.07.2017 Advisory communicated to N-CERT because CIPHRON received no response 17.07.2017 Coordination with heinekingmedia about further procedure 18.07.2017 Commentary of the vendor about the findings received by heinekingmedia 19.07.2017 Remarks about the commentary communication to heinekingmedia 19.07.2017 Communication of the updated advisory draft including the commentary 19.07.2017 Coordindation of the advisory publication 19.07.2017 Note that the findings will be fixed until the end of next week 28.07.2017 Note that patches of the findings are ready 28.07.2017 Discussion of the patches 31.07.2017 Publication of the advisory 8. About CIPHRON ================ The CIPHRON GmbH was founded in 2003 and is a consultancy for information security with its central office in Hannover, Germany. As a consultancy for information security, CIPHRON does penetration tests, code reviews and individual research about security topics. More information are available at http://ciphron.de -- Karsten-Kai KAPnig, IT Security Consultant CIPHRON GmbH Tel.: +49 (5 11) 51 51 33 - 0 Fax: +49 (5 11) 51 51 33 - 29 Web: http://www.ciphron.de/ Support: +49 (5 11) 51 51 33 - 11 Ust.Id.: DE263362886 GeschA$?ftsfA1/4hrer: Sebastian Horzela Amtsgericht Hannover, HRB 203590Dear