Auditing NQ Contacts Backup & Restore 1.1

NQ Contacts Backup & Restore is an android app that allows users to backup and restore contact data (as vcard) to/from the remote NQ server. For the audit, the android app was the primary target.

 Note: The app shares its code base with NQ Mobile Security & Anti Virus - hence the odd class names for a simple contact backup app.

Lack of HTTPS usage

 When logging in or transmitting data, the app communicates with the remote server via HTTP. This can be exploited in various ways. One of these is sniffing the request when a user logs in:


 

As you can see, the username is being transmitted in cleartext.  The password is hashed with SHA-1.
An attacker can now crack the SHA-1 hash (because that's pretty easy nowadays):



Additionally, an attacker could use the sniffed hash to download the stored contacts from the server directly. As described later, the attacker can also access transmitted contact data.

Vulnerability type: Plaintext data transport
Affected Product Code Base: NQ Contacts Backup & Restore - 1.1
Affected Component: Basically every component executing network action. For the login process: ContactAccountLogin and ContactAccountSwitch
Impact: Information Disclosure of sensitive data (login data)

RC4 encryption with static key

 The app uses the RC4 stream cipher to encrypt/decrypt password stored in the android shared preferences. The file looks like this:





The decryption routine, which can be found in DataUtils, look as follows:



The stored value is base64-decoded and passed to the RC4 algorithm. The first parameter of decryptForXml is a static key, as you can see here:


Using this knowledge, it's easy to decrypt the stored password value from the shared preferences XML file:


 This makes it easier for an attacker to decrypt login data of users.

Vulnerability type: Usage of a static encryption key
Affected Product Code Base: NQ Contacts Backup & Restore - 1.1
Affected Component: NetQinSharedPreferences
Impact: Information Disclosure of login data

DES encryption with static key

When syncing user data (e.g. contacts as vcards), the app uses DES encrypted zip files, as you can see in the class ServerBackupDoing$7 :






 In the class DesCript, there are two static keys:



The key named keyByte is used to create a KeySpec, which represents the key being used to encrypt/decrypt data.


As there is no HTTPS in place, it's therefore possible for an attacker to gain access to sensitive contact data.

Vulnerability type: Usage of a static encryption key
Affected Product Code Base: NQ Contacts Backup & Restore - 1.1
Affected Component: ServerBackupDoing, DesCript
Impact: Information Disclosure of user data (contact data)

Popular posts from this blog

Auditing WriteDiary.com (CVE-2017-15581 & CVE-2017-15582)

Auditing the Oral-B App (v5.0.0)