Investigating Mobile Messaging Security Elias Hazboun 27/4/2016 - - PowerPoint PPT Presentation
Chair for Network Architectures and Services Technische Universit at M unchen Investigating Mobile Messaging Security Elias Hazboun 27/4/2016 Chair for Network Architectures and Services Department of Informatics Technische Universit
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
27/4/2016 Chair for Network Architectures and Services Department of Informatics Technische Universit¨ at M¨ unchen
1
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
Introduction Research Question App Selection
Approach Security background Related Work
TextSecure Threema WeChat WhatsApp
2
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Mobile messaging apps have become very popular. ◮ People are opting to communicate using the Internet
◮ Unlike Email and other communication protocols, most
◮ Hinders interoperability [1]. ◮ No transparency in handling users’ data.
◮ Users are still not well informed about the risks of
3
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Investigate the security properties of a selection of today’s
◮ Encryption & Authentication. ◮ Standardized security protocol usage.
4
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Continuation of work done in this chair [3].
◮ Security in relation to users’ geo-location.
◮ Selection was based on popularity, security measures,
◮ Tested apps were:
◮ WhatsApp ◮ Threema ◮ WeChat ◮ TextSecure
5
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Investigating:
◮ Official app documentation ◮ Past research efforts, from scientific community and
◮ Could be obsolete by newer updates. ◮ Network traffic analysis. ◮ Capture process done by the previous work using two
◮ 407 capture files per smartphone per app. ◮ Manual and automated script analysis.
6
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
7
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Perfect Forward Secrecy (PFS)
◮ Compromise of long-term keys used to negotiate session
◮ Most commonly achieved using ephemeral Diffie-Hellman
◮ Important against an attacker model that can store arbitrary
◮ Transprot Layer Protocol (TLS)
◮ De facto Standard protocol for security between client and
8
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Certificate Pinning
◮ Insertion of public key or certificate of the entity with which
◮ Removes need to trusted third party certificate authorities.
◮ Asynchronous Messaging Security:
◮ Not all parties are guaranteed to be online at the same time
◮ Creates a challenge. Protocols like OpenPGP are used but
◮ Trusted third parties for key distribution can be used.
9
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Interest has been growing in the past few years, especially
◮ Focus of research include:
◮ Authentication process when registering [6]. ◮ Receiving unsolicited messages. ◮ Phonebook enumeration. ◮ Local security (security of data on smartphone) [7] [8]. ◮ Network traffic based analysis [9] [10].
◮ Results show a trend of negligence of security from
10
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Developed by Open Whisper Systems in 2010. ◮ Only app out of four to be open Source. ◮ End-to-end encryption and hardened security in general as
◮ Discontinued and replaced by Signal app and Signal
◮ Direct code inspection due to open source nature. ◮ Forsch et al [11] found some peculiarities such as
◮ Developers acknowledged it.
11
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ End-to-end encryption.
◮ Axolotl ratchet (DH ratchet and key derivation based
◮ Guarantees PFS and backward secrecy. ◮ DH ratchet creates keys used for session keys, which are
◮ Transport layer encryption.
◮ TLS with self-signed certificate pinning. (The same in all
◮ Cipher was ECDHE RSA WITH AES 128 GCM SHA256.
12
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ When an App registers it:
◮ Creates 100 prekeys (signed key exchange messages) [14]. ◮ Sends them to server.
◮ When a user wants to communicate with another:
◮ Sender asks for next valid prekey. ◮ Calculates a shared secret based on it and encrypts
◮ AES is used for symmetric encryption.
◮ Two levels of symmetric encryption are used to protect the
13
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Developed by Threema GmbH, Popular in German
◮ Promises end-to-end encryption and data hosting on swiss
◮ Partly open source, publishes white paper about security
◮ Allowed an external security audit of the app. ◮ Jan Ahrens [15] provided an analysis on Threema protocol. ◮ Dimitrov, Laan and Pineda [16] analysis demonstrated with
14
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Handshake process is similar to what is described in
◮ No standardized protocol use.
◮ Binary protocol implemented using NaCl Library. ◮ Directory service and media transfer protocol use HTTPS.
◮ PFS only on transport layer, not end-to-end [17]. ◮ Random padding is used.
◮ Messages with same plaintext size are encrypted into
15
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
16
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Developed by Tenecent. ◮ One of the largest messaging apps by monthly active
◮ Feature rich app offering lots of additions. ◮ Closed source, but has public API for messaging through
◮ Roberto Paleari [18] performed network traffic analysis.
◮ It uses a custom protocol similar to HTTPS
17
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Even DNS queries are peformed over HTTP [3]. ◮ Uses AES for symmetric encryption. ◮ No indication for the existence of end-to-end encryption or
◮ Key derivation is suspected to be done using RSA [18].
◮ Could not verify ourselves.
◮ Out of the 4 apps. WeChat is the more obscure and more
18
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Developed by WhatsApp Inc. (bought by Facebook) ◮ Second most popular messaging app in the world (1 billion
◮ Closed source. ◮ Past research found lots of deficiencies [6] [19].
◮ Started as plaintext. Upgraded to weak encryption [20] [21]. ◮ non-secure user registration process.
◮ Funcional clone projects exist [22] [23]. Almost complete
19
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Current state is much improved compared to previous
◮ All security is centered around a 20-byte password (pw)
◮ Sent to the app once over TLS connection.
◮ To communicate using the app, a three way handshake is
◮ Client Hello. ◮ Server hello with challenge data (used as nonce). ◮ Client authentication using pw and challenge data.
20
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ After the first handshake. Communication with server is
◮ Server also sends new challenge data to be used for future
◮ If pw is compromised, past and future traffic might be
◮ There needs to be a traffic capture starting with a plaintext
◮ pw is dangerous: Known to the server and is sent once
◮ No other layer of security exists.
◮ WhatsApp Announced in late 2014 a partnership with
21
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
22
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
◮ Two approaches to applying security.
◮ Build your app and then add security features when they
◮ Start with security level in mind and build your service as
◮ Open source and public/standard protocols vs closed
◮ From best to worst: TextSecure, Threema, WhatsApp,
23
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
24
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
25
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
[1] P . Dashtinejad, Security System for Mobile Messaging Applications. PhD thesis, KTH Royal Institute of Technology, 2016. [2] B. Adida, S. Hohenberger, and R. L. Rivest, Lightweight Encryption for Email. USENIX Association, 2016. [3] Q. Scheitle, M. Wachs, J. Zirngibl, and G. Carle, “Analyzing Locality of Mobile Messaging Traffic using the MATAdOR Framework,” in PAM, 2016. [4] E. Rescorla, “Diffie-Hellman Key Agreement Method,” RFC 2631, RFC Editor, June 1999. http://www.rfc-editor.org/rfc/rfc2631.txt. [5] N. Unger, S. Dechand, J. Bonneau, S. Fahl, H. Perl, I. Goldberg, and M. Smith, “SoK: Secure Messaging,” in Security and Privacy (SP), 2015 IEEE Symposium
[6] R. Mueller, S. Schrittwieser, P . Fruehwirt, P . Kieseberg, and E. Weippl, “What’s new with WhatsApp & Co.? Revisiting the Security of Smartphone Messaging Applications,” in Proceedings of the 16th International Conference on Information Integration and Web-based Applications & Services, pp. 142–151, ACM, 2014. [7] C. Anglano, “Forensic Analysis of WhatsApp Messenger on Android Smartphones,” Digital Investigation, vol. 11, no. 3, pp. 201–213, 2014.
26
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
[8] A. Mahajan, M. S. Dahiya, and H. P . Sanghvi, “Forensic Analysis of Instant Messenger Applications on Android Devices,” CoRR, vol. abs/1304.4915, 2013. [9] A. Azfar, K.-K. R. Choo, and L. Liu, “Android Mobile VoIP apps: a Survey and Examination of Their Security and Privacy,” Electronic Commerce Research,
[10] F. Karpisek, I. Baggili, and F. Breitinger, “WhatsApp Network Forensics: Decrypting and Understanding the WhatsApp Call Signaling Messages,” Digital Investigation, vol. 15, pp. 110–118, 2015. [11] T. Frosch, C. Mainka, C. Bader, F. Bergsma, J. Schwenk, and T. Holz, “How Secure is TextSecure?,” IACR Cryptology ePrint Archive, vol. 2014, p. 904, 2014. [12] M. Marlinspike, “Advanced Cryptographic Ratcheting,” 2013. [13] L. Onwuzurike and E. De Cristofaro, “Danger is my middle name: Experimenting with ssl vulnerabilities in android apps,” in Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks, WiSec ’15, (New York, NY, USA), pp. 15:1–15:6, ACM, 2015. [14] M. Marlinspike, “Forward Secrecy for Asynchronous Messages,” 2016. [15] J. Ahrens, “Threema Protocol Analysis.” http: //blog.jan-ahrens.eu/files/threema-protocol-analysis.pdf, 2014.
27
Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen
[16] H. Dimitrov, G. Pineda, and J. Laan, “Threema Security Assessment.” https://www.os3.nl/_media/2013-2014/courses/ssn/projects/ threema_report.pdf, 2013. [17] T. GmbH, “Threema Cryptography Whitepaper,” tech. rep., Threema GmbH, 2015. [18] R. Paleari, “A Look at WeChat Security,” 2013. [19] C. Rottermanner, P . Kieseberg, M. Huber, M. Schmiedecker, and S. Schrittwieser, “Privacy and data protection in smartphone messengers.” https://www.sba-research.org/wp-content/uploads/ publications/paper_drafthp.pdf, 2015. [20] R. Eikenberg, “WhatsApp versendet keinen Klartext mehr,” 2012. [21] F. Balducci, “WhatsApp is Broken, Really Broken,” 2012. [22] “The PHP WhatsApp Library,” 2016. [23] “The Python WhatsApp Library,” 2016. [24] M. Marlinspike, “Open Whisper Systems Partners With WhatsApp to Provide End-to-End Encryption,” 2016.
28