Avoiding damage, shame and regrets data protection for mobile client-server architectures

Avoiding damage, shame and regretsdata protection for mobile client-server architectures

#doios @vixentael

is intuitive, evolution trained us for it

Real-world security

Meet Dodo birds!

Alice Bob

data protection for client-server apps #doios @vixentael

They are chatting together

Alice Bob


tweet hello

Here comes Eve..


..the eavesdropping Fennec Fox

Eve eavesdrops

danger


tweet ack

ear radars: ON 😈

Birds fly away, Eve doesn’t hear them


secure place

hear nothing 😭

Risk (threat): Eve hears your secrets

Mitigation: physically move away from Eve

Real-world security

evolution did not prepare you for that!

Cyber-world security

Apple Secure Coding Guide

Every program is a potential target.

Your customers’ property and your reputation

are at stake.

https://developer.apple.com/library/mac/documentation/Security/Conceptual/SecureCodingGuide/

Introduction.html


https://developer.apple.com/library/mac/documentation/Security/Conceptual/SecureCodingGuide/Introduction.html

What we protect?

User’s data!


in storage

in motion

in memory

Data in motion

There are hackers..

and threats these hackers exploit..

to create damage


Problem: Layer 1

Meet Alice-the-App and Bob-the-Server

Alice-the-App Bob-the-Server


Client and Server are communicating


passw: 123456

HTTP 1.1

Alice-the-App Bob-the-Server

Eve-the-Hacker


Here Eve-the-Hacker comes!

passw: 123456HTTP 1.1


Here Eve-the-Hacker comes!

passw: 123456HTTP 1.1


{“passw”:“123456”}

Let’s go deeper..

To avoid threats we need

secure programming


Problem: Layer 2

Alice decides to implement security


puts on paper hat!

Bob decides to implement security

builds the fence!


..and they decide to use HTTPS!


****** : ******

HTTPS out of the

box

But it’s not really secure..

****** : ******HTTPS out of the box


{“passw”:“123456”}

Intercept traffic using proxy


* SSL experimenting with Android Top100 apps

http://bit.ly/1NqpheM

* Intercepting the App Store's Traffic on iOS

http://bit.ly/1H3xMrs

http://bit.ly/1NqpheM

http://bit.ly/1H3xMrs

What helps Eve to eavesdrop?

๏ not encrypting user data


๏ plain HTTP ๏ self-signed certificates

๏ HTTPS with old cipher-suites

๏ using vulnerable libraries and bad examples from StackOverflow

๏ SSL without SSL certificate pinning


Problem: Layer 3

As the result,

Programming is rarely secure


Software is buggy

http://blog.mindedsecurity.com/2015/03/ssl-mitm-attack-in-afnetworking-251-do.html

AFNetworking SSL verification bug (v2.5.1-2.5.2)

https://eprint.iacr.org/2013/049.pdf

Out-of-the-box SSL is frequent subject to attacks

http://www.dwheeler.com/essays/apple-goto-fail.html

Apple “goto fail” vulnerability

http://noxxi.de/howto/ssl-debugging.html

http://blog.mindedsecurity.com/2015/03/ssl-mitm-attack-in-afnetworking-251-do.html

https://eprint.iacr.org/2013/049.pdf

http://www.dwheeler.com/essays/apple-goto-fail.html

http://noxxi.de/howto/ssl-debugging.html

๏ Copying bad code from StackOverflow ๏ Debugging by tearing security suites

apart ๏ Avoiding “complicated” security

documentation


Software is buggy. Why?

- is easy to f*ck up

- is inconvenient to implement

Cyber-world security

- use good practice and brain

- use good tools

- minimize re-inventing the wheel

What shall we do?


Realize threat vectorsBad cryptography No access control Authentication bypass Credential reuse Session hijacking Denial of Service Data leakage …

Anyone can invent a security system that he himself cannot break

— Schneier's Lawhttps://www.schneier.com/blog/archives/

2011/04/schneiers_law.html


Implementing security tools yourself is a threat

https://www.schneier.com/blog/archives/2011/04/schneiers_law.html

Do not re-implement existing things


Use great toolsscientific background trust big guys good track record


libsodium/NaCL OTRKit

RNCryptor MIHCrypto

Themis

https://github.com/mochtu/libsodium-ios

https://github.com/ChatSecure/OTRKit

https://github.com/RNCryptor/RNCryptor

https://github.com/hohl/MIHCrypto

https://github.com/cossacklabs/themis

https://github.com/mochtu/libsodium-ios

https://github.com/ChatSecure/OTRKit

https://github.com/RNCryptor/RNCryptor

https://github.com/hohl/MIHCrypto


Apple open sourced crypto


Armoring your SSL

Do your SSL/TLS right

๏use long keys

๏disable backward compatibility

๏use strong ciphers (EC vs RSA)

๏pin SSL certificate

๏use cheat sheet

https://www.cossacklabs.com/avoid-ssl-for-your-next-app.html

SSL has a lot of problems

To survive you need to:


https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet

https://www.cossacklabs.com/avoid-ssl-for-your-next-app.html

https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet

Do you pin SSL certificate?


SSL/TLS in short


hello

client asks certificate

server sends cert

encrypted data

client verifies cert - domain, - expiration date, - asks CA if cert is valid and not revoked

key negotiation

Where can it break?


hello


server sends cert

encrypted data

client verifies cert - domain, - expiration date, - asks CA if cert is valid and not revoked

key negotiation

SSL pinning


hello


server sends cert

encrypted data

client verifies cert - compares cert against pinned cert

key negotiation

SSL pinning on iOS

https://possiblemobile.com/2013/03/ssl-pinning-for-increased-app-security/ https://www.paypal-engineering.com/2015/10/14/key-pinning-in-mobile-

applications/

-‐ (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {

SecTrustRef serverTrust = challenge.protectionSpace.serverTrust; id<NSURLAuthenticationChallengeSender> sender = challenge.sender; SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, 0); NSData * remoteCertificateData = CFBridgingRelease(SecCertificateCopyData(certificate)); NSString * cerPath = [[NSBundle mainBundle] pathForResource:@"MyLocalCertificate" ofType:@"cer"]; NSData * localCertData = [NSData dataWithContentsOfFile:cerPath]; if ([remoteCertificateData isEqualToData:localCertData]) { NSURLCredential * credential = [NSURLCredential credentialForTrust:serverTrust]; [sender useCredential:credential forAuthenticationChallenge:challenge]; } else { [sender cancelAuthenticationChallenge:challenge]; } }


https://possiblemobile.com/2013/03/ssl-pinning-for-increased-app-security/

https://www.paypal-engineering.com/2015/10/14/key-pinning-in-mobile-applications/

SSL pinning more easy :)

let certData = NSData(contentsOfFile:

NSBundle.mainBundle().pathForResource("lvwenhancom", ofType: "cer")!)!... ...

.addSSLPinning(LocalCertData: certData) { () -‐> Void in print("Under Man-‐in-‐the-‐middle attack!")}


Swift lib for HTTPS and SSL pinning

https://github.com/johnlui/Pitaya https://github.com/iSECPartners/ssl-conservatory

https://github.com/johnlui/Pitaya

https://github.com/iSECPartners/ssl-conservatory

Nah.

SSL is not enough :(

So, we’re done?

Implementing Forward Secrecy

Forward Secrecy: ThreatEve records encrypted

traffic

New crypto vulnerability allows to exact keys

Eve physically extracts keys from one of the birds

Eve decrypts all encrypted traffic


Forward Secrecy: Mitigation

Forward Secrecy

ephemeral keys + key rotation scheme


https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf

SSL/TLS has forward secrecy but it’s weak:

=

https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf

Using ephemeral key


key negotiation (RSA or EC)

create symmetric temp key

use temp key to encrypt messages

during session

close session

open session

Implementing ephemeral keys

1. establish session

2. encrypt message with SecureSession before sending

3. decrypt message after receive

4. encrypt history with SecureCell



Themis has built-in forward secrecy inside SecureSession object


Implementing ephemeral keys


https://github.com/cossacklabs/mobile-websocket-example

https://github.com/cossacklabs/mobile-websocket-example

Data in storage

What we need to do 1. Choose good storage library with

efficient crypto

2. Embed it on read/write

3. Store keys safely


RNCryptor example

Themis SecureCell example


Storage libraries


Storing the keys

SSKeychain example

Valet example

https://github.com/square/Valet

https://github.com/soffes/sskeychain

https://github.com/square/Valet

https://github.com/soffes/sskeychain

compute key and use KDF to derive


Storing the keys: Computable obfuscation

https://www.mikeash.com/pyblog/friday-qa-2012-08-10-a-tour-of-commoncrypto.html

key = KDF(sqrt(42)*len(user_id)/parity(user_id))

https://www.mikeash.com/pyblog/friday-qa-2012-08-10-a-tour-of-commoncrypto.html

Ending notes

Practical app security step by step1.Use HTTPS with good TLS settings

2.Enable SSL pinning

3.Encrypt user data in motion with ephemeral keys

4.Encrypt stored data and protect the key


Alice is more secure now


SSL pinning

encrypted storage data

ephemeral keys

Bob is more secure now


encrypted storage data

ephemeral keys

Chatting is more secure

5720b3c2 fe674f54

73e10ad4 ...

HTTPS

SSL pinning

ephemeral keys


Security is full of adventures and

discoveries. And fun. an

d sh

iny

met

al b

irds

!

The last slide@vixentael iOS developer

at stanfy.com [creating awesome mobile

and IoT apps]


take care!

http://stanfy.com

More to read★ The Mobile Application Hacker's Handbook https://books.google.com.ua/books?id=UgVhBgAAQBAJ

★ Designing Secure User Interfaces https://developer.apple.com/library/ios/documentation/Security/Conceptual/SecureCodingGuide/Articles/AppInterfaces.html#//apple_ref/doc/uid/TP40002862-SW1

★ CryptoCat iOS app security audit https://nabla-c0d3.github.io/documents/iSEC_Cryptocat_iOS.pdf

★ Storing secret keys http://www.splinter.com.au/2014/09/16/storing-secret-keys/

https://books.google.com.ua/books?id=UgVhBgAAQBAJ

https://developer.apple.com/library/ios/documentation/Security/Conceptual/SecureCodingGuide/Articles/AppInterfaces.html#//apple_ref/doc/uid/TP40002862-SW1

https://nabla-c0d3.github.io/documents/iSEC_Cryptocat_iOS.pdf

http://www.splinter.com.au/2014/09/16/storing-secret-keys/

More to watch★ All talks of Moxie Marlinspike https://www.youtube.com/watch?v=ibF36Yyeehw https://www.youtube.com/watch?v=8N4sb-SEpcg https://www.youtube.com/watch?v=tOMiAeRwpPA

https://www.youtube.com/watch?v=ibF36Yyeehw

https://www.youtube.com/watch?v=8N4sb-SEpcg

https://www.youtube.com/watch?v=tOMiAeRwpPA

Avoiding damage, shame and regrets data protection for mobile client-server architectures

Mobile

Transcript of Avoiding damage, shame and regrets data protection for mobile client-server architectures