Whatsapp security torn apart

Whatsapp is something you probably use right now, or atleast heard of its name. It is a cross platform IM application for smartphones. Along with messages, people can also send audio, video and images. It is available for all leading smartphone platforms like android, iOS, blackberry, Symbian, Windows etc. Whatsapp handles a few billion messages everyday. That is, approx. more than 50,000 messages are being sent every second! This signifies the popularity of this smartphone app. That is incredible success for a company which was started just a few years ago.

Indeed whatsapp is a great alternative to conventional texting, no doubt. But along with all the merits and successes, this app has got some drawbacks too. It has been heavily criticized for its security issues, mainly cryptographic standards and the way it handles user's personal data. Following paragraphs will elaborate on the security mechanisms this app uses.

As most of the popular instant messaging clients like yahoo and gtalk do, whatsapp uses XMPP i.e. eXtensible Messaging and Presence Protocol. Whatsapp implements a modified version of this standard. On installing this app, it creates an account on whatsapp's server.
Its username, or technically known as 'Jabber ID' is concatenation of the user's country code and their mobile number.
For example, 911234567890 where 91 is the country code followed by 10 digit mobile number.
username : <mobile no>@s.whatsapp.net

There's something interesting about the password. It is generated from the phone's IMEI number or MAC address.
For android devices, the password is md5 hash of the phone IMEI no reversed.
password : md5(strrev($imei))
For iOS devices, the password is md5 hash of the device's Wireless Interface card MAC address, written twice. Mac address is concatenated with itself and its md5 is found out.
password : md5(mac+mac)

Messages are sent as TCP packets. As whatsapp puts it, no messages are stored on their servers once they're delivered to the recipient. For sending of multimedia like audio, video or pictures, the data is first uploaded to the HTTP server. A link to the uploaded file is sent to the recepient's phone alongwith thumbnail file, if required.

Previously, till August 12, 2012, messages were being sent in cleartext. Anyone on the same wifi network was able to sniff the packets and read messages. This gave attackers ability to launch a session hijacking attack. However, currently messages are being sent encrypted for iOS and android. Whatsapp does not specify what encryption standard it implements for some undisclosed location. The encryption algorithm it uses currently has been reverse engineered, especially for iOS devices. Here's a link to the article:
http://pastebin.com/g9UPuviz
Overall verdict is that the current encryption mechanisms are not according to a standard.

This app uses phone's IMEI number or mac address as password. Something that is easily accessible to someone in physical contact with the phone. IMEI number can be found out with apps available in the market, also it is printed on the back side of the battery. Someone using the same wifi network as you, can easily find out the mac address of the iOS device, without being in physical contact, by sniffing. Therefore, anyone using a public wifi for whatsapp is at risk of getting their data sniffed and their account can be used to send and receive messages. All an attacker has to know is victim's mobile number (which is obviously known to him) and the phone's mac address or IMEI to enter into a script. Then they are able to send and receive messages from the compromised account.

Initial login at whatsapp's server uses digest access authentication. You can try this out yourself:
https://r.whatsapp.net/v1/exist.php?cc=<country code>&in=<mobile no>&udid=<password>

Here,
country code and mobile no are to be replaced by your country code and mobile no, and password is something you can get from md5 of IMEI or Mac, as explained earlier.
On successful request, it should give you a status response 'ok' meaning that you're valid over there on whatsapp.. :P
Although whatspp doesn't officially provide its API, there is an open source project called 'WhatsAPI'. Those guys have done a great job of creating whatsapp's API by reverse engineering. It has been very popular though some legal issues have been surrounding it recently.
https://github.com/venomous0x/WhatsAPI
This API is coded in both PHP and Python and can be used in integration with web apps. It can be used to send whatsapp messages to any number. Other such third party web-based API is available:
http://www.whatsapp-api.com/

The API itself is hosted on their site and can be accessed with HTTP requests. Although this service costs money to start using it. 
One more thing we all know, whatsapp shares your contacts with their server to see which contacts are present. The way it is done is very insecure. The mobile numbers of your contacts are sent as an array through HTTP request parameter as follows:

https://sro.whatsapp.net/client/iphone/iq.php?cd=1&cc=$countrycode&me=$yournumber&u[]=$friend1&u[]=$friend2&u[]=$friend3&u[]=$friend4

The verdict... as you can see, whatsapp has got so much to work on security. At the same time, its presence cannot be denied in our daily life. iOS users, do not use it on public wifi, 3G or your own wifi with no other users will do. If you are concerned about security, avoid giving your phone to people who you don't trust because that will be an easy way for them to know your IMEI. We hope that they come up with better alternative to current passwords and standard cryptography implementations to increase reputability with the security community too :)

Exploiting eval() function in Python

          I came across a pretty interesting function in python yesterday while coding. It is the eval() function. Basically it takes a string which has a valid python expression, and evaluates it as a regular python code. The risk with this function, if the user manages to enter custom crafted string into this function, it has capability to execute shell commands. Once a remote attacker manages to enter shell commands into your python file hosted on web server, it won't be long before you have to run to the office at midnight because you got a call that web server is compromised.

Here's a link to the usage of eval() function in official python documentation.
          http://docs.python.org/library/functions.html#eval

Using eval function:
The following example demonstrates how eval() works:

         
So it simply takes a string as expression and evaluates it. How can we exploit it to get shell codes executed? There are few ways of doing so.

1. Consider running the following code:

          >>> eval("os.getcwd()")

     This will give your present working directory. You can execute other functions of OS module too, like this one.

         >>>eval("os.system('clear')")

     

     This call will clear the console window and will just display a '0' which i guess is the return value of that function. It works on linux only, windows users, try replacing 'clear' with 'CLS'.

Okay that's there, but how can a potential attacker exploit it? well, what if you replace os.system('clear') with something like os.system('rm -rf /') ?  You get the point right... :D

p.s. please don't execute this one unless you want a clean slate!

2. There's another interesting module in python called as 'subprocess'. 

     http://docs.python.org/library/subprocess.html

The subprocess module allows spanning of new processes and connecting their i/o through pipes. As the official documentation puts it, it intends to replace older modules and functions including os.system.

with the getoutput() function you can execute commands and get their output as follows:

          >>> import subprocess

          >>> subprocess.getoutput('ls')

          >>>eval("subprocess.getoutput('pwd')")

Again, ls or pwd can be replaced by more harmful commands, something like, "rm /etc/passwd" or "rm /any/file/present" depending on your current user privileges.

          >>>eval("subprocess.getoutput('rm /any/file/present')")

Wait a minute!

This only works if you have the OS module or subprocess module imported right? The program you're trying to exploit must have these modules imported in advance. Try running the command

          >>> eval("os.getcwd()")

without importing the OS module. It will give a NameError saying that name 'os' is not defined.

Well, there is a way around this...

There's a global __import__() function in python. It accepts a module name and imports it.

Hence,

__import__('os')

will import the os module and will return a reference to this module. Through this, we can execute functions in the OS module with malicious parameters. The crafted eval() function will look like this:

         >>> eval('__import__("subprocess").getoutput("ls")')

That's all from the attacker point of view, here's how we can 'try' to minimize the risk associated with eval() function.

If you've seen the official documentation of eval(), there are second and third parameters that this function accepts. They are the global and local namespaces that this function accepts for evaluating the expression. The global namespace must be a dictionary while local namespace can be any mapping object.

This example demonstrates how global namespace works. In the first attempt, our global and local namespaces are blank, indicated by {},{} parameters. (by the way, these namespaces are dictionaries that map its index element to its value) Hence, there is no reference of the 'num' object that python can find. Hence it raises an exception saying that 'num' is not defined.

In the second attempt, we set the reference of "num" to the num variable that we have set to 10. Hence now the python can evaluate num*num and return 100.

So, does setting global and local namespaces to blank ({},{}) solve our problem of arbitrary command execution?

               >>> eval('__import__("os").getcwd()',{},{})

It doesn't... because __import__ is a part of "__builtins__" pseudo module. This module and its functions are available to the python program unless you manually restrict it. Now, in the global namespace, you will map "__builtins__" to something blank, empty, a None object maybe. This will prevent the __import__ function (or any other function from __builtins__ ) getting called. Global namespace will look like, {"__builtins__":None} or {"__builtins__":{}}

Hence, now the function,

     >>> eval('__import__("os").getcwd()',{"__builtins__":{}},{})

Will fail because it can't find any reference to __import__ and os either.

This will mitigate most of the security risks, but is still not a foolproof solution. There are ways to bypass the __builtins__:None too, but that is out of the scope of this article.

There are other ways of securing your eval() function too, like removing all the double underscores ("__") from a string before it is passed over to the eval function. This should prevent most of the attacks as of now unless someone comes up with a new method to bypass this. :D

astring = "This string has __double__ underscores"

astring = astring.replace("__","")

The above string can now be passed to the eval function.

One more way, use the literal_eval from the module "ast". ast.literal_eval is a much more secure way to evaluate python strings than the generic eval() function. More documentation about ast module can be found here.

http://docs.python.org/library/ast.html

There are other such dangerous functions in python too, like exec() or file exec and again, there are ways to exploit these and also ways to thwart possible attacks. Input validation plays important role here if you are deploying these on web server or any other public server.

Thanks for reading! :)

Local DNS Cache Poisoning

You’ve heard about the DNS while configuring your internet connection. You enter two DNS values, one primary DNS and another secondary DNS. DNS is fundamental for the functioning of internet. Through this article, I will explain what DNS is, why it is necessary, how it works and a simple DNS cache poisoning attack. Let’s get started…

What is DNS?

DNS stands for ‘Domain Name System’. The official Wikipedia definition goes something like this:
     The Domain Name System (DNS) is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network.

Basically, DNS is a service that translates human recognizable domain names (such as www.google.com, twitter.com etc) to their respective IP addresses.

On the internet or any IP network, computers and servers recognize each other by their IP address and not their domain names like google.com. Therefore, it is necessary to convert the domain name which you type in the address bar of your browser to its respective IP address i.e. the IP address where the server residing. Then your browser can establish connection with that server and start exchange of data.

Why DNS is necessary?

It’s difficult for ordinary people to remember hundreds of IP addresses which belong to different web servers. Naturally it’s easier to remember the domain names. This practice of using simpler names, rather than IP addresses, dates back to the ARPANET era. Computers used to have something called as a ‘hosts’ file which mapped computer names to their respective ip address.

In 1983 the DNS was invented which was followed by BIND server, the first DNS server based on unix platform. This eliminated the need for end users to maintain a hosts file.

Another advantage of DNS is that, even if the web server changes its IP address or migrates from one location to the other on internet; its domain name remains the same. Hence end user does not need to worry about the mapped ip address by the DNS service. The DNS servers can add or update DNS entries/records internally.

How does DNS work?

From a client’s point of view, working of DNS is very simple. It sends the request to the configured DNS server. The server sends back the answer and the client establishes a connection with that host. The sequence of steps that take place are as follows:

1.      User types www.example.com in his web browser.

2.      The computer sends request to the DNS server that it is configured to use. The request goes like this – “Where is www.example.com?”

3.      The DNS server receives this request and begins looking up its database to find entry for www.example.com. Luckily, this time, it finds the entry and corresponding IP address (say 192.0.43.10).

4.      It replies back to the client – “www.example.com is at 192.0.43.10”

5.      Client receives this response and starts communicating with the ip address.

Actually, DNS is a distributed system. All the DNS servers are interdependent to resolve an IP address completely. Suppose you made a DNS query for www.microsoft.com and the DNS server you are assigned to, finds that it doesn’t have that record present in its database. How can it find out where www.microsoft.com resides?

Structure of the distributed system

To find out where a particular host belongs, the client has to make recursive DNS queries to reach to the authoritative name server for that particular domain. As the name implies, authoritative name servers have authority over their respective domain name. Authoritative name servers can assign authoritative name servers for their sub domains. Anyway, look at the following hierarchy of the distributed domain name space. Yup, it’s a tree as we studied in the discrete mathematics class… :-P

Whenever a client has to find an IP address corresponding to a host, say, www.microsoft.com, it performs recursive DNS queries on the respective authoritative name servers. A root name server has authentic records of all the ‘Top level domains’ (.com, .org, .net etc.). The name servers for TLDs have records for all the domain names under them e.g. example.com, google.com etc. The process goes like this…

Client        : I wanna go to www.microsoft.com, but I don’t have any records corresponding to that. I know, I’ll ask the root name server.

*client sends request to root name server*

Root name server           : Hmm, I see you’re going to a “.com” domain, Here’s the address of “.com” TLD. Go and ask him.

*client receives the address sends request to .com TLD server*

.com TLD                          : Well, Microsoft.com comes under me. And here’s the address of “Microsoft.com” authoritative name server. You’ll get your answer from there!

*client receives the address and sends request to Microsoft.com nameserver*

Microsoft.com NS           :Hello, You’ve come to right place. I’m the authoritative nameserver for www.microsoft.com and here’s its IP address.

*client receives the address of www.microsoft.com and starts communication with the web server*

Poof, as you can see, resolving domain names is a complicated process and generate a lot of load on the root nameservers as well as TLD nameservers.

To overcome this, your local DNS servers (maybe servers assigned by your ISP) cache the DNS records in their own database such that each time a client makes a request, they don’t have to make recursive DNS queries. They can respond with the matching DNS record entry in their own cache. This also takes away a lot of load from root and TLD nameservers.

DNS Cache Poisoning:

Alright, now let’s look at DNS from a hacker’s point of view. If one can manipulate the records in the DNS cache server, the records are said to be poisoned. An attacker can change the IP address corresponding to a legitimate domain name. Whenever a client requests for this legitimate domain name resolution, they’ll be provided with this spoofed IP address which the attacker inserted. The attacker may have hosted some malicious website on this ip address or maybe created a replica of the original legitimate website for phishing purposes. The number of things an attacker can do with a spoofed DNS record are many. In a nutshell, a poisoned or a compromised DNS server provides invalid or illegitimate DNS resolutions which may point to malicious websites.

Local DNS cache poisoning:

As we’ve seen before, each computer has a ‘hosts’ file which maps domain names to their corresponding IP addresses. Remember when I said client goes to its local DNS server when the user types in a website name? I lied. :-P First of all, the client checks its own ‘hosts’ file if it can find the corresponding entry there. If it doesn’t, then it goes to the local DNS server. Here we’re going to manipulate the hosts file on our PC to redirect some legitimate website names to wherever we want.

Windows users can find the hosts file at the following location:

C:\Windows\System32\drivers\etc\hosts

Remember that hosts file does not have any extension.

Linux users, the hosts file is located at:

/etc/hosts

Edit the hosts file with your favorite editor. Remember that you need administrator privileges on windows and root privileges on linux to be able to do that.

Anyway, the hosts file may look like this:

Now add the following text to the end of the file:

127.0.0.1     www.facebook.com

On windows, it will look like this:

Here, www.facebook.com is the website name which will get redirected, you can replace this with any other website name you want. 127.0.0.1 is the IP address where www.facebook.com will point to. In our case, this is the local loopback IP address, you can replace this by any other ip.

Save the file and try opening www.facebook.com or whatever website name you typed through your browser. It will open your localhost and if there’s no web server currently running, it will say page cannot be displayed.

There are some applications of manipulating hosts file. In home or office environment, a hosts file can be used to block social networking and adult pornography websites just by setting them to point to your localhost or any other webpage on your network containing a warning. Also hosts file can be used for DNS cache poisoning as we saw just now. Legitimate website names may redirect you to a malicious website which may try to introduce Trojans, viruses on your PC or try to phish your online banking or social networking account.

One may also write a simple bash script or a batch file that may manipulate or replace hosts file automatically. This technique is been used in some viruses and worms to poison DNS cache of thousands of innocent users to land them on malicious or spoofed websites. It is advisable to follow the best security practices.

Thank you for following me throughout this article and I hope you’ve found this informative. Waiting for your comments… :)

This article is for information purposes only.