1337 Security

NQ Contacts Backup & Restore is an android app that allows users to backup and restore contact data (as vcard) to/from the remote NQ server. For the audit, the android app was the primary target.  Note: The app shares its code base with NQ Mobile Security & Anti Virus  - hence the odd class names for a simple contact backup app. Lack of HTTPS usage  When logging in or transmitting data, the app communicates with the remote server via HTTP. This can be exploited in various ways. One of these is sniffing the request when a user logs in:   As you can see, the username is being transmitted in cleartext.  The password is hashed with SHA-1. An attacker can now crack the SHA-1 hash (because that's pretty easy nowadays): Additionally, an attacker could use the sniffed hash to download the stored contacts from the server directly. As described later, the attacker can also access transmitted contact data. Vulnerability type: Plaintext data transport Affected Prod

General note: The developer and owner of both the webapp and android app has been contacted multiple times to develop a quick fix for the issues addressed in this blog post and a vulnerability concerning the webapp which isn't described here. However, no response has been received. WriteDiary consists of a webapp ( WriteDiary.com ) and an android app  (version 4.72). For the audit, the android app was the primary target. CVE-2017-15581 : Lack of HTTPS-usage, lack of user data encryption when transmitting In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS (check strings.xml for api_url_prod :  http ://diary.adpog.com/api2)  nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of secrets and feelings," which allows remote attackers to obtain sensitive information by sniffing the network during LoginActivity or NoteActivity execution.