Author: eighthave
Source
We received an audit on the new “index-v2” work in official Android client
app + API (3 days) and the new front end webserver setup (1 day). There
were no findings for the webserver setup, so the analysis in this post deals
with the F-Droid client app. The audit was conducted by Radically Open
Security, which is a natural partner
for F-Droid since they share a focus on free software and open processes.
Thanks to NLnet for finding the auditor and covering the
costs of hiring them. We are making the original report available for
download.
This post was written in the spirit of transparency with technical detail
about the risks of each vulnerability. We welcome further scrutiny. For
more information about F-Droid’s security practices, see the documentation
about the Security Model.
CLN-002 – XML parsers might be vulnerable to XXE attacks
- Vulnerability type: Input validation
- Threat level: Elevated
The application’s XML parser implementation might be vulnerable to XML
External Entity (XXE) attacks.
Impact
If the XML parser has no restrictions for external and internal entities,
then this might lead to arbitrary file disclosures or server-side request
forgery (SSRF) vulnerabilities when XML input is parsed.
Our Response
The original index file, the version 0 format, is an XML file generated as
part of any repo. It is available at either index.xml or the more recent
signed version at index.jar. Recent versions of the client will always
try index-v1.jar first, which is a signed JSON format. If that is not
available, the client will fallback to index.jar. index.jar is also
used for the “nearby” app swapping functionality. All of these index.jar
files must pass the signature verification before the XML is parsed.
Successful exploitation of this would require either a) the attacker was
able to get the target to add a malicious repo, or b) the attacker was able
to get the repo signing keys and then break into an existing repo’s server
and replace the index files. For example, a malicious actor could try to
exploit someone via Nearby app swapping, so only get apps from people you
trust. The way that the client is set up to parse the XML was vulnerable,
and would allow a successful attacker to read files that the F-Droid app can
read
For f-droid.org and the Guardian Project repo, the index files are
monitored, and changes to them are logged. So we can say with high
confidence that index-v1.jar was never removed, which is a prerequisite
for exploiting this vulnerability.
F-Droid client v1.15.4 disables all support for XML External Entities. The
v1.16-alpha0 no longer supports XML indexes at all, and all code related to
the XML index parsing and generation was removed. We will also be working
on improving the security of adding repos as part of the FFDW-DVD
funding.
CLN-005 – Vulnerable TLS versions accepted
- Vulnerability type: Insecure configuration
- Threat level: Elevated
The backend domains used by the application accept obsolete TLS 1.0 and TLS
1.1 protocols.
Impact
Use of TLS 1.0 and 1.1 make the communication susceptible to downgrade
attacks, as they work on SHA-1 hash for the integrity of exchanged
messages. The handshake authentication is also done on SHA-1, which makes it
easier for an attacker to impersonate a server for MITM attacks. The PCI DSS
(Payment Card Industry Data Security Standard) specifies that TLS 1.0 may no
longer be used as of June 30, 2018, and also strongly recommends disabling
1.1, so this may impact compliance with regulations.
Our Response
F-Droid places a high importance on maintaining compatibility as long as
possible. This is why we leave TLS 1.0 and TLS 1.1 enabled on our
websites. We believe there is no added risk for people who keep their
software updated. The F-Droid Client app does not allow TLS 1.1 or 1.0
connections. TLS 1.3 provides good downgrade protection, TLS 1.2 less. Any
reputable TLS implementation from the past years make it quite difficult to
force a connection to use TLS 1.0 or 1.1. Recent browser
releases
are entirely removing support for TLS 1.0 and 1.1 anyway. That means that
any browser or client version that connects over TLS 1.0 or 1.1 actually
needs that to function. A device running Android 1.6 should be able to
install an old version of F-Droid, and have a working app store.
If you are on a device that still needs to use TLS 1.0 or 1.1, then there
are already so many well known security vulnerabilities that this one is not
particularly interesting. If you would like to test whether your browser
still supports TLS 1.0 or 1.1, click on the links below and see if they give
you an error message.
CLN-001 – Encryption algorithms using insecure mode and padding scheme
- Vulnerability type: Weak Cryptography
- Threat level: Low
The encryption algorithms used in the app use an insecure mode and padding
scheme.
Impact
If sensitive data is being encrypted using an insecure mode and padding, it
might lead to data being stolen or recovered from the encrypted data.
Our Response
This was only ever used to sign the app index file used in the Nearby app
swapping, which only works over the local network. The signature is on a
short-lived file that is generated on the fly, and is almost always used in
a one-to-one interaction. A lot of other pieces would have to be in place
for this to be exploited. Plus it would require a fair amount of expense to
crack the cryptography on the file that was signed seconds or minutes
before, and probably will only be in use for around 10 minutes. Any app
updates received via Nearby swapping will still have the full protection of
the APK signature. For these reasons, it is also still safe to use the SHA1
algorithm, which is necessary here for compatibility. This use case falls
under the “second preimage
attack”
case, meaning that the attacker cannot affect the data before it is
signed. Git can also still rely on SHA1 for this reason.
F-Droid client v1.15.4 and v1.16-alpha1 switched from RSA/ECB/PKCS1Padding
to the standard SHA1withRSA algorithm for signing the Nearby index.jar.
The new “index-v2” for repositories added in v1.16-alpha0 uses
SHA256withRSA as the signing algorithm. The official client always starts
by trying the latest index version in each repository, and v1.16 added
downgrade protection so a repo that already offers index-v2 can’t be
downgraded to index-v1.
CLN-003 – Clear text traffic is enabled in the application
- Vulnerability type: Insecure configuration
- Threat level: Low
The base network config of the application allows clear-text traffic.
Impact
Allowing clear-text traffic impacts confidentiality, authenticity, and
protection against tampering. An attacker performing a machine-in-the-middle
attack can eavesdrop on transmitted data and modify it without being
detected.
Our Response
This Android feature for blocking clear text HTTP connections is a good
feature that apps should use. Having this disabled is obviously not ideal,
but it is something we had to do to support the local HTTP swap
functionality, and also HTTP .onion addresses in the past (there is another
workaround possible these days). So we have taken extra measures to enforce
HTTPS:
This vulnerability applies to the exact same context as CLN-001: Nearby app
swapping. So it is already a quite limited environment for malicious actors
to operate in. This does not affect built-in repos at all, since they are
hard-coded to HTTPS. Plus good webserver setups like f-droid.org do not
allow data to be sent over plain HTTP.
CLN-004 – HTTP Request URLs are logged
- Vulnerability type: Information leakage
- Threat level: Low
The Android app (org.fdroid.fdroid.debug
ver. 1.14-alpha3-505-gc8514adb9-debug) logs URLs.
Impact
Logging sensitive information in the Android log is not a recommended
practice as this information can (in some scenarios) be accessed by other
applications on the same device. URLs can contain tokens or other sensitive
data which might be logged, leading to the disclosure of that data to other
apps.
Our Response
Privacy is important, and we want to ensure that any potentially private
information is not leaked, even at the cost of easier debugging or service
analytics. So we appreciate the auditor’s level of attention in reporting
this issue and have removed the URLs from the logging on release builds.
This vulnerability does not affect the security of operations. Many web
services put private tokens in URLs, and logging those would be like leaking
clear text passwords. All the well known repositories including f-droid.org
are run as a static website, so there are no user accounts. The issue here is
if someone got the “logcat” text, which is generally protected in Android,
and apps cannot simply read the text anymore. One potential leak scenario
would be if someone installed a sensitive app, then uninstalled it. That
app install and uninstall would be listed in the log, available if the user
was compelled to provide that log, or if the device was exploited to get
access to protected data.
This will be fixed
in the final v1.16 release.
(This work was funded by NLnet under an ongoing project known as Tracking
the Trackers and The Search
for Ethical Apps under the umbrella
of Guardian
Project)
