full-disclosure - Android HTC Mail insecure password management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 5 Aug 2012 12:57:10 -0700
From: vtalk@...view.com
To: full-disclosure@...ts.grok.org.uk
Subject: Android HTC Mail insecure password management

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Android HTC Mail insecure password management

Classification:
===============
Level: low-[MED]-high-crit
ID: HEXVIEW*2012*08*05*01
URL: http://www.hexview.com/docs/20120805-1.txt

Overview:
=========
HTC is $9.5B(USD) Taiwanese manufacturer of smartphones and tablets, primarily
Android-based. HTC's devices account for 5% of the smartphone market and for
about 15% of all Android devices sold in the US. Most HTC devices come with an
application called HTC Mail. HexView discovered that HTC Mail insecurely stores
mailbox credentials.

Affected products:
==================
HTC Mail application, all versions (package: com.htc.android.mail)

Vulnerability Summary:
======================
Android OS comes with a feature called AccountManager that lets applications
manage user credentials in a more or less secure fashion. HTC Mail instead stores
usernames and passwords directly in its database obfuscated with a weak, trivial
to reverse algorithm.

Technical Details:
==================
HTC Mail application stores user credentials in the 'accounts' table in its 'mail.db'
SQLite database. The table contains usernames, email addresses, hostnames, mailbox
and SMTP passwords for each mail account configured in the Mail application. All data
is stored in a plain text except for passwords that are "encrypted" as follows:
1. Password characters at odd and even positions are swapped.
2. The byteswapped string is base-64 encoded twice.
3. The resulting base64-encoded password is stored in the database.

Demonstration:
==================
HexView produced a script for the GameSpector application (available in Google Play)
that decodes and displays HTC mail passwords. GameSpector requires root access.

Distribution:
=============
This document may be freely distributed through any channels as long as
its content is kept intact. Commercial use of the information in the 
document is not allowed without written permission from HexView.
Please direct all questions to vtalk@...view.com

About HexView:
==============
HexView is a technology consulting boutique offering a variety of information
security services, including security assessments of mobile applications.
For more information visit http://www.hexview.com

Feedback and comments:
======================
Feedback and questions about this disclosure are welcome at vtalk@...view.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAlAezhcACgkQDPV1+KQrDqQW8gCfcT0koImRoJppbUwVkweaoxmG
xD4Anj4osjlOWR1JmnWbLAwcoeHN0UjJ
=g+yV
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/