Message-ID: <1438059632522.91428@precipice.fi>
Date: Tue, 28 Jul 2015 05:00:39 +0000
From: Samuel Lavitt - CVE-2015-0942 <CVE-2015-0942@...cipice.fi>
To: Full Disclosure <fulldisclosure@...lists.org>,
  BugTraq <bugtraq@...urityfocus.com>
CC: Samuel Lavitt - CVE-2015-0942 <CVE-2015-0942@...cipice.fi>
Subject: Multiple unresolved vulnerabilities in Basware Banking/Maksuliikenne

English: Multiple vulnerabilities in Basware Banking/Maksuliikenne software that were reported already 08/2012 may still enable undetectable economic crimes against user organizations (companies)
Finnish: Basware Banking/Maksuliikenne -ohjelmiston haavoittuvuudet, joista raportoitiin jo 08/2012, saattavat edelleen mahdollistaa käyttäjäyrityksiin kohdistuvia ”näkymättömiä” talousrikoksia
Swedish: Sårbarheter i Basware Banking/Maksuliikenne programvaran, vilka rapporterades redan 08/2012, kan fortfarande möjliggöra “osynlig” ekonomisk kriminalitet mot användarföretag 

Security researcher, author: Samuel Lavitt <cve-2015-0942@...cipice.fi>
Editor and translator: Ronja Addams-Moring <ronja@...cipice.fi>


English Summary:
Basware Banking/Maksuliikenne, a cash/bank account management software package for enterprises from software vendor Basware, has multiple critical vulnerabilities, which are described in this report. These vulnerabilities were first observed and reported to Basware by security researcher and author of this report, Samuel Lavitt, in August 2012. These vulnerabilities, and exploits to unlawfully gain economically from them in an undetectable manner, were demonstrated by the author to Basware and CERT-FI (part of the National Cyber Security Centre Finland) on 7 July 2014. The Finnish Financial Supervisory Authority was also informed in July 2014. At least one vulnerability has been partially fixed since.
Despite that fix it is still, to the best of the author’s knowledge, possible to:
-    Duplicate a user organization’s digital banking security keys, which are used to authenticate the banking transactions.
-    Modify all the records in the user organization’s Basware Banking software, including transaction records as well as pending transactions.
-    Bypass all permission restrictions (access controls) in the user organization’s client software.
These risks affect at least 1,500 user organizations (companies) in the Nordic and Baltic countries, mainly in Finland and Sweden. Protecting against these risks may require a complete reset of all affected digital banking keys, in addition to security fixes to the software, or discontinuing the use of the vulnerable software. To implement these changes and prevent possible fraud due to the vulnerabilities that allow the copying of banking keys, each user organization may require the assistance of banks where they have granted the Basware Banking/Maksuliikenne software access to their bank accounts. Depending on how processes are defined and technical controls implemented in each bank, making the required changes may or may not also have an impact on other bank customers who do not use the Basware Banking/Maksuliikenne software.

Yhteenveto suomeksi:
Basware Banking/Maksuliikenne, yritysten rahan ja pankkitilien hallintaan tarkoitettu ohjelmistopaketti ohjelmistotoimittaja Baswarelta, sisältää useita kriittisiä haavoittuvuuksia, jotka on kuvattu tässä raportissa. Tämän raportin kirjoittaja, turvallisuusasiantuntija Samuel Lavitt havaitsi nämä haavoittuvuudet ensimmäisen kerran ja ilmoitti niistä Baswarelle elokuussa 2012. Nämä haavoittuvuudet sekä sen, miten niitä hyödyntämällä on mahdollista saada oikeudetonta taloudellista etua ilman, että sitä voidaan havaita, kirjoittaja osoitti Baswaren ja CERT-FI:n (osa Viestintäviraston Kyberturvallisuuskeskusta) edustajille demonstraatiossa 7. heinäkuuta 2014. Myös Finanssivalvonnalle ilmoitettiin asiasta heinäkuussa 2014. Ainakin yksi haavoittuvuuksista on sittemmin osittain korjattu.
Raportin kirjoittajan parhaan tiedon mukaan korjauksesta huolimatta on edelleen mahdollista:
-    Monistaa käyttäjäorganisaation pankkitoimintaa turvaavia digitaalisia avaimia, joita käytetään pankkitapahtumien todentamiseen.
-    Muokata kaikkia käyttäjäorganisaation Basware Maksuliikenne -ohjelmiston sisältämiä tietoja, kuten tilitietoja sekä jonossa olevia (ajastettuja) pankkitapahtumia.
-    Ohittaa kaikki käyttöoikeusrajoitukset (pääsynvalvonta) käyttäjäorganisaation asiakasohjelmassa.
Nämä riskit vaikuttavat ainakin 1500 käyttäjäorganisaatioon (yritykseen) Pohjoismaissa ja Baltian maissa, pääasiassa Suomessa ja Ruotsissa. Näiltä riskeiltä suojautuminen saattaa edellyttää kaikkien haavoittuvuuden vaikutuspiirissä olevien digitaalisten pankkiavainten uusimista, sen lisäksi että ohjelmiston turva-aukot on korjattava tai on lopetettava haavoittuvan ohjelmiston käyttö. Jotta nämä muutokset voidaan toteuttaa ja mahdolliset petokset haavoittuvuuden kautta kopioitujen pankkiavainten avulla estää, kukin käyttäjäorganisaatio saattaa tarvita apua kaikilta niiltä pankeilta, joissa se on antanut Basware Maksuliikenne -ohjelmistolle oikeudet käsitellä pankkitilejään. Riippuen siitä, miten kussakin pankissa prosessit on määritelty ja turvaratkaisut toteutettu, tarvittavien muutosten tekeminen saattaa vaikuttaa tai olla vaikuttamatta myös muihin pankkiasiakkaisiin, jotka eivät käytä Basware Maksuliikenne -ohjelmistoa.

Sammanfattning på svenska:
Basware Banking/Maksuliikenne, ett programvarupaket för företag för penning- och bankkontohantering, utgivet av mjukvaruleverantören Basware, har flera kritiska sårbarheter som beskrivs i denna rapport. Dessa sårbarheter observerades och rapporterades till Basware av författaren till denna rapport, Samuel Lavitt, för första gången i augusti 2012. Dessa sårbarheter, och hur man med hjälp av dem kan få obehörig ekonomisk vinning på ett sätt som inte går att spåra, demonstrerades av författaren för Basware och CERT-FI (en del av Kommunikationsverkets Cybersäkerhetscenter i Finland) den 7e juli 2014. Även Finansinspektionen i Finland informerades i juli 2014. Åtminstone en av sårbarheterna har delvis korrigerats sedan dess.
Trots korrigeringen är det, enligt författarens bästa förståelse möjligt att:
-    Duplicera en användarorganisations digitala banksäkerhetsnycklar, som används för att autentisera banktransaktioner.
-    Ändra all information i användarorganisationens Basware Banking programvara, inklusive transaktionshistorik samt de transaktioner som väntar i kö.
-    Ta bort alla behörighetsbegränsningar (åtkomstkontroll) i användarorganisationens klientprogramvara.
Dessa risker påverkar minst 1500 användarorganisationer (företag) i de nordiska och baltiska länderna, främst i Finland och Sverige. För att skydda sig mot dessa risker, kan det vara nödvändigt att helt förnya de berörda digitala banksäkerhetsnycklarna, förutom att också korrigera sårbarheterna i programvaran, eller sluta använda den sårbara programvaran. En användarorganisation kan behöva hjälp av de banker, där de har givit Basware Banking programvaran rätt att använda sina bankonton, för att åstadkomma dessa förändringar och förhindra möjligt bedrägeri genom de sårbarheter som tillåter att banksäkerhetsnycklarna kopieras. Beroende på hur processerna är definierade och den tekniska säkerheten är förverkligad i en bank, kan förverkligande av de nödvändiga förändringarna antingen påverka eller inte påverka även andra bankkunder som inte använder Basware Banking programvaran.


Full report, English only


Description of the affected software:
The Basware Banking/Maksuliikenne software (henceforth “the software”) is a cash/bank account management software package for enterprises from software vendor Basware (henceforth “the vendor”).  According to the best information the author of this report has, it is used by between 1,500 and 2,000 customer organizations, primarily companies throughout the Nordic and Baltic regions.  The software operates as a thick client/server package, with both clients and servers running on the Windows platform.  The server component is primarily an IBM Solid database server.  It is possible to have the client and server components installed and operating on the same system. In that case, if the system has a properly configured firewall preventing unauthorized access, the CVE-2015-0943 vulnerability described below can be effectively mitigated.


Description of the vulnerabilities:
In August 2012 and June—July 2014, multiple vulnerabilities were found in the software by the author and reported to the vendor.  Because the vendor was unable to reproduce the issues described or to confirm the presence of any vulnerability, a demonstration was given to the vendor as well as to CERT-FI in July 2014.  The author was later informed by CERT-FI that the vendor stated all but one of these security issues had been fixed and that the fixes had been made available to affected customers. However, the author has not been provided with updated software to verify the resolutions himself.  This report is based on the author’s best knowledge on 27 July 2015. Affected version ranges and fixed version information are incomplete.  Two CVE numbers were provided to the author by CERT-FI for the vulnerabilities: one for the issue that was still considered unresolved, and one for all issues that the vendor stated were resolved.

CVE-2015-0942
CVSSv2 score: 10.0 – Critical
CVSS v2 Vector (AV:N/AC:L/Au:N/C:C/I:C/A:C)
The issues in CVE-2015-0942 are issues that the vendor has informed the author to be resolved, with fixes available to customers, but the latest update provided by the vendor to the author does not appear to adequately resolve them. Affected versions are at minimum 8.40.1.0 to 8.90.07.X (The latest provided to the author).

Issue #1: Hard-coded account used for account management
All instances of the software use the same hard-coded account with an identical password for account management.  This account, with the name "ANCO", is not only identical for all installations, but is also used for security-sensitive tasks.  This account has sufficient permissions to perform account management tasks on other accounts, such as locking or unlocking other user accounts, as well as updating the audit trails for other accounts.
As of version 8.90.07.X, a static account for account management tasks is still present. However, the account no longer has full database permissions.  The account name (and possibly password) is also different for each installation of the software, but can be found using information that can be accessed using an additional hard-coded account that was added to the server, which uses the same username and password for all installations.

Issue #2: Use of client-side access control/auditing only
The software performs login verification, audit trail creation, and even account locking via client-side functions.  By simply dropping network traffic related to these functions, it is possible to disrupt security-critical functions, such as audit-trail creation for failed login attempts and account locking to prevent brute force attacks. As of version 8.90.07.X an attacker can even prevent the client from locking an account to prevent brute forcing by ending the software’s process via the Windows Task Manager; the account is only locked after acknowledging the notification.
In addition, the author discovered that as of version 8.90.07.X, possibly as part of the changes to prevent abuse of the account for account management described in issue #1 above, accounts are no longer locked/disabled at all in the server.  Instead, the account name is added to a table of locked accounts, and after a successful login as a user, a check of that table is made to see if the account is considered “locked”.  If the account is in the locked account table, the client software prompts that the user account is locked and logs the user out.  This is purely a client-side check and the users actually have full permissions to modify the contents of that table, which allows any user to delete their own account lock.

Issue #3: Unprotected storage of private keys used for banking transactions
The private keys that are used by the software to communicate with the customer organization's bank are available to users of the software in plain text (or trivially protected in later versions) in the SQL database.  As of version 8.90.07.X  these keys are available to all users of the software, even if the access control policies provided to the system administrators are specifically set to restrict access from the users.  The usage of these keys allows an attacker to completely bypass the control mechanisms in place and impersonate the software or a valid authorized account holder to various online banking systems directly, enabling authentication of fraudulent requests.

Issue CVE-2015-0943
CVSSv2 Score: 8.3 – High
CVSS v2 Vector (AV:A/AC:L/Au:N/C:C/I:C/A:C)
The vendor has informed the author and customers in an email sent 13 October 2014 to all customers that this issue will be resolved in 2015 using native Solid DB encryption. Affected versions are at minimum 8.40.1.0 to 8.90.07.X.

Issue #4: Use of plain text for all SQL server communications
The communications between the thick client and the backend (SQL) server are done in plain text and without tamper protection.  Any hostile actor who is able to perform a man-in-the-middle attack on the communications can manipulate all information sent between the SQL server and the client. A man-in-the-middle attack would allow complete modification of all banking/payment information, access to bank account encryption keys, modification of all payment records, etc.  Even if an attacker is not able to perform a man-in-the-middle attack on the communications, access to packet captures can still reveal sensitive banking information, user credentials for the banking system, and possibly also encryption keys, which might allow direct impersonation of authorized users to the banks.  There is also no replay protection, so an attacker who has a copy of the messages sent from the client to the server during user login can reuse those same messages to gain full access to the banking server.
This issue was partially confirmed by the vendor in an announcement sent to their customers in October 2014, with an offer of a work-around using 3rd-party solutions provided by contacting vendor support.


Suggestions for organizations using the software:
Disclaimer: The suggestions below may assist your risk management or information security department in determining appropriate actions for your organization based on your environment and security posture.  These suggestions are in no way meant to be instructions or to provide protection against or detection of abuse.  Any response should be tailored to your organization by competent internal or external experts who understand the software vulnerabilities as well as your organization's policies, procedures, and operational environment.
-    Contact Basware and ensure that you are running the latest version of the Banking software.  Follow any recommendations applicable provided by Basware to reduce your security  risks.
-    Have the software evaluated in your environment by a skilled security engineer or penetration tester to validate that these security vulnerabilities have been resolved.
-    Move the Banking server to a location where it is only accessible from trusted networks.
-    Remove unneeded user accounts or accounts belonging to untrusted users from the Banking software.
-    Consider transferring money out of accounts managed by the Banking software to reduce the amount of financial damage in case of a breach, and keeping minimal operating expenses in the at-risk accounts.
-    Perform internal audit of bank account balances and transaction history, retrieving the account information directly from the bank. This is recommended because the records in the Banking software can be tampered with.
-    Consider blocking all network access to the Banking server and performing transactions using only clients installed on the same system as the server.
-    Investigate whether the security of your environment may have been compromised at any time, or whether the Banking software may have been accessible directly.  If so, contact all banks that have private keys stored in the software to revoke those keys as a fraud prevention measure. Securely replace those keys only after the risks have been addressed.
-    Use a third-party encryption solution that provides strong encryption and authentication of network communications for the Banking software to protect against tampering, and ensure that only encrypted and authenticated connections to the Banking server are possible.
-    Install current anti-virus and anti-malware software as well as all vendor-provided security updates on the Banking server and any computers where the Banking client is used. 
-    Consider using whitelisting to control the software allowed to execute on the Banking server as well as on any computers where the Banking client is used.
-    Establish procedures as part of the software acquisition process to verify vendor security claims as well as fitness for use.


Timeline
Dates are approximate and to the best of the author’s memory, as the author was not the primary person handling communications with the vendor.
August, 2012
    The author discovered plain-text unauthenticated communications and client-side account locking bypass in a previous version (8.40.1.0) and informed vendor support personnel when they were resolving another issue with the software. Vendor support said that the author was incorrect, as the software version in question was outdated, and had known security issues.  The author was told by the vendor’s support technician that the security issues were already resolved in an update, which would be installed by the vendor in the near future.
September, 2013
    The software was updated to version 8.70.0.0 as part of other updates.  The author did not verify at that time that the update resolved the security issues that had been found.
19 June, 2014
    The author encountered the software again and discovered that the same issues still existed. Further research was done by the author and the vendor was contacted with detailed findings. The author offered to provide a demo as the vendor reported that they were unable to reproduce the issues.
7 July, 2014
    The author provided a demo for the vendor and CERT-FI, showing the vulnerabilities and working proof-of-concept exploits, which gave the ability to change bank account balances and the records of banking transactions in the system, as well as copying the private banking keys used for communication with the banks.
Week of 7 July, 2014
    Confirmation was received from the vendor that they were able to reproduce the findings now that the issue was understood.  The author was informed that the vendor was working towards providing a fix and would keep the author updated.
Regularly from this point on, the author checked with the party handling communication with the vendor, but was not given any update on the issue or told anything about fixes being available.
14 January, 2015
    The author was informed that all security issues had been resolved by the vendor.   The author was asked to re-verify his findings in the software installation.
15 January, 2015
    The author confirmed that all security issues still applied and that the  software installation was not updated.  Further updates were requested from the vendor.
Week of 23 February, 2015
    The author was informed that someone in the media had found out about the security vulnerabilities and was preparing to go public.  The author contacted CERT-FI to organize CVE numbers and was told that progress had been made and CERT-FI had been told by the vendor that all but one of the vulnerabilities were resolved.  CERT-FI was asked by the author to encourage the vendor to respond to communication attempts and to provide the security updates for review.
4 March, 2015
    The product manager for the vendor contacted the author, offering to provide installation of security updates.  This was scheduled for 11 March.
6 March, 2015
    Helsingin Sanomat (HS) published an article on Basware security vulnerabilities.  Following this, CERT-FI published their statements in Finnish and in English.  The author was asked by CERT-FI not to disclose any more details until the author evaluated the security fixes, in case the fixes were inadequate.
-    The HS article “Paha tietoturva-aukko altistaa yritykset valemaksuille”: (Finnish only, English translation of the title is “Bad security vulnerability exposes companies to fraudulent payments”): http://www.hs.fi/talous/a1425539014674
-    CERT-FI publication “Vulnerabilities in Basware Banking“ (English): https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html
-    CERT-FI publication “Haavoittuvuuksia Basware Maksuliikenne -ohjelmistossa “ (Finnish):
https://www.viestintavirasto.fi/kyberturvallisuus/haavoittuvuudet/2015/haavoittuvuus-2015-018.html
11 March, 2015
    The vendor provided updates, but it became apparent to the author during this process that issues still remained unresolved.  CERT-FI was contacted and it was agreed that they would send a technical expert to assist with a review.
13 March, 2015
    The author and a technical expert from CERT-FI thoroughly analyzed the software and determined that the findings described above were still valid.  The author was asked to give the vendor 42 days to resolve the issues before public disclosure.
28 July, 2015
    Full disclosure.

Powered by blists - more mailing lists