3

I have recently been digging through windows store apps in order to see what dumb things engineers are putting in the store. Recently, I found an ssl.pem file deployed with an app.

I never ran this app, so I don't believe this file was generated locally. I think they deploy it with the app. I just installed it from the Windows store and started digging.

My assumption is, with the ssl.pem file, I should be able to:

  • MiTM someone that is using the app
  • Feed the pem file to Wireshark
  • Decrypt and inspect all their traffic.

Is this a realistic attack? Is there something I'm missing?

Also, is it common to deploy an app with a pem file inside? I would imagine you'd want to generate that on a per session basis.

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCzWhBE5GUB5sCu
OhIktg+7uVTlaGGsvnM3yQxRw90GkadVUEUCekHuCjYn36zG+8ZKE1wyJnoPjARw
VBTNenFUmyDsajNwuVWYUqBfnrj9f5rLyhZHXN8GQ9wVNUSnop6lo1pUAJ2DKxTI
JbhNorGr2+u315AtesTqYjw6pdj1QmnOYW7Be10aDujxMB19ULY3fDoU+IRzqGIa
EVvyyX88ZNDQJrPtoN9AYoaoF5UDyc92Pc8yWpd7cZKJf9/4VNqSShRY3Ta6bmay
tjJjSHGC84o+6Xm6Vq+scZWQQvJYjcCvdCrbKFLlsuiuxyojyBqH/Bsn3OlsZ1KE
f7BDHICLAgMBAAECggEBAIJF0floeGHILX6f2ZvmzkjJ1nuHtSLXdzM3Coa9oObr
l0LluiqRiSARNMMDuikSqjYWF+qpfhGa34KD4FRcMsOEpoZyoYioZh7tLWYnETG4
pUSPNl2BfNG9KrgQ6Bxnh5rCq5LGm6KyATdcBqIFoc42QOJZZnVSboPc9OiYnJ2P
9401ZTQ7cgz0/doYx3PmixVXt8jZSq9GRAVcwlWixTy2LgH3R0VUOmqfYGv1GsGx
ARNYj46tJ2psoVLsn8jPAesCB8CkcNoB4+x98t5dH9hBlQbIErcO8Cm0uXTq370L
BuSF6F38rAey+g2zJWeClRxF+pBJh4M6oO9cSmHWF7kCgYEA2+Kp6x7pzIJFmKPy
CCmz2otBe2ox4hM2BTAYDS9ma3Q2vEX0D1Btw2SC6ZAfo8Vs3QTjvN+PkcRwi251
z6bspGPYbUApblfF+bDb9D6lyG6OJeqIxVt6Vf+fizMvL5qV+8irgYiThmUF9YAJ
1jqECeroVI83WEWa87CDSlaMuf0CgYEA0M8eMMf1ASHZyXU+ol9JuPsqg40XCPt7
5A4U6IHj3EUDTn7og5SMp/kkAig06YLrs8t1g9vHOwAgOc393lFyIpspfpkTMtj3
Pk9ETVFPFTASyCUtGK6jF27fwib5gLE1Ir3KMzcz3RoZYlPbLJBHf3u7/T6CPGCE
gt7HKiCjRycCgYEAjYa4o1MEXNNEhFiRgduFnZagERVrAf4nePNZp7LokyT7zfag
ffLgkzDwafCPzNNXnHJ3OqwSNlpfrf7s6Tihe7WgKcFwaUspa+r/x5dDEVzHNXRd
j9mvRgb/45KQPm2bN7ITYY5MleYUDc3Zhv+m2NNPso1zq+cxMsRb3M8USOkCgYA0
z11EWx4U9jm9oOCBcnYTybo74TAlPm1cBU+2ajt11yJ59NDbjnNwfCtmPEL9l/YC
1/9VpP0jZ+m+lOGTG6gxJmr9MLvRTVxiruuIXnsQ0cK+SeC48FohMBJ5aSALM0ZM
DhIYl+qPDe3Dl4/EGo1qqaGm7+tCV+rLqopWlkCVWwKBgQCO01VJrp5T9fbkwjjF
JYDdrq9UCtTOQ+Qy/W7/blSxnRkO67raaGA0qek9ZPAtnG1TpeX9Bo0LZhGf/DcE
rB8sJpR71b+TtL9XlG1eu5ZzpURgpO+4WouoatMANLGsPvwlJ9vzX4sHAMT0lf50
Ck/qzYOPVwrdhd6htkYQ59XbpA==
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIJAMSNkfAcfcwzMA0GCSqGSIb3DQEBCwUAMIGHMQswCQYD
VQQGEwJTRTESMBAGA1UECAwJU3RvY2tob2xtMRIwEAYDVQQHDAlTdG9ja2hvbG0x
DTALBgNVBAoMBEtpbmcxDjAMBgNVBAsMBUNhbmR5MQ0wCwYDVQQDDARLaW5nMSIw
IAYJKoZIhvcNAQkBFhNzdHJpdHotZGV2QGtpbmcuY29tMB4XDTE2MDIwODEyMzky
OFoXDTE4MTEwNDEyMzkyOFowgYcxCzAJBgNVBAYTAlNFMRIwEAYDVQQIDAlTdG9j
a2hvbG0xEjAQBgNVBAcMCVN0b2NraG9sbTENMAsGA1UECgwES2luZzEOMAwGA1UE
CwwFQ2FuZHkxDTALBgNVBAMMBEtpbmcxIjAgBgkqhkiG9w0BCQEWE3N0cml0ei1k
ZXZAa2luZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzWhBE
5GUB5sCuOhIktg+7uVTlaGGsvnM3yQxRw90GkadVUEUCekHuCjYn36zG+8ZKE1wy
JnoPjARwVBTNenFUmyDsajNwuVWYUqBfnrj9f5rLyhZHXN8GQ9wVNUSnop6lo1pU
AJ2DKxTIJbhNorGr2+u315AtesTqYjw6pdj1QmnOYW7Be10aDujxMB19ULY3fDoU
+IRzqGIaEVvyyX88ZNDQJrPtoN9AYoaoF5UDyc92Pc8yWpd7cZKJf9/4VNqSShRY
3Ta6bmaytjJjSHGC84o+6Xm6Vq+scZWQQvJYjcCvdCrbKFLlsuiuxyojyBqH/Bsn
3OlsZ1KEf7BDHICLAgMBAAGjUDBOMB0GA1UdDgQWBBR0arfWGx19kisUiaB/OF4o
xiolEzAfBgNVHSMEGDAWgBR0arfWGx19kisUiaB/OF4oxiolEzAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBA4iPNPv7VbabYQMJtqZ7CL+0s5vH7Oq4D
QXPko3H/dXZ/11Sglujm/2YlYfYIU1CXghZB6TnhSnYncG6gGMT0CmH/7zUkBrYl
6dVODXPGKNrstNVB7Z1y4aNkmn/wiLKgdN0/zv8CePZwgIBQ7HsF7O/THA7ceZov
aM8y8LLjP8GY8l1beZpOBbcPKm7trhTujT1Gm97CfZZU/H3yW+aoc1rLVVlqnwyi
H3A2kquscy8eKOimdUtcIuI5kfnOumAnrNCrszlrwgLeRfO5E3Ztvd/ktGNFGcGF
8zIGTdEblECUxLgpKxmYtNdMDYUXDtqZ4nz49eZONOAzmA9r0Qjb
-----END CERTIFICATE-----
  • Well, we don't know if this key actually is used for decrypting sensitive (or any kind of important) data. It also could be eg. part of a (insecure dumb) method to prevent any server access from outside of their own app. Or plenty other things. ... But still, you're probably right. And I can't help to get amazed at the stupidity of people again and again. – deviantfan Jul 16 '18 at 23:50
  • 2
    (And given that this is a game with billions of downloads... sigh) – deviantfan Jul 16 '18 at 23:54
1

Deploying a PEM file that is signed by a trusted root CA, even if you self-signed the root CA, is common. I have configured and deployed a public key infrastructure, with hierarchy:

  • root CA
  • intermediate CA
  • server certificate

NextCloud deploys a similar configuration for authenticating in-app updates, which uses a self-signed root CA. As they control the root CA, and subsequently all proceeding signed certificates, with the option to revoke certificates on demand.

The answer, MiTM someone that is using the app yes, under certain conditions. Presuming a web server is deployed using HTTPS without forward secrecy (PFS) and you control the web server's private key used to initiate the key exchange, you could have intercepted the session and key exchange, then use WireShark to decrypt the relevant packets for the key exchange using the server's private key. Then you would have the symmetric decryption key(s) for the session(s).

To harden your app against a viable MITM attack consider:

  • Please notice it is a self signed cert. No PKI was used. – goteguru Jul 18 '18 at 9:50
  • Also notice that it includes the private key. Having a pem file with the public key could be used for key pinning without bothering with a PKI, the real problem is that the private key is included. – AndrolGenhald Jul 18 '18 at 14:42
  • Without a PKI, compromise of the certificate could result in problems long term, it entirely depends on what the certificate is being used for. -- I should also clarify certain criticism my answer has received. A MITM attack is possible under all conditions. However, I was referring to the ability to actively decrypt data via the key exchange, which would not be viable using PFS without modifying traffic (see Diffie-Hellman). Furthermore, this answer is speculative, because it involves broad security aspects, from my interpretation of the question. – safesploit Jul 18 '18 at 14:44
  • @AndrolGenhald PKP is a brilliant idea, just acknowledge the risks of implementing it. The private key is used for signing, otherwise no authentication can be performed. This is why I suggest a PKI with PFS, as authentication requires the corresponding private key, for the certificate (public key). The app for this to be secure need to be run server-side, otherwise, the client-side code needs to encrypt with a public key and send to a centralised server with the private key for decryption. A PEM is not ideal for this, instead, have two files Public Key and Private key. – safesploit Jul 18 '18 at 14:53
2

It depends on the usage. Since you've posted the certificate we can see it's a self signed certificate with the corresponding private key, valid to Nov 4 12:39:28 2018 GMT. You probably extracted it from the Candy Crush game.

Most possibly it's worthless (you can generate any number of certs like this), unless it is used for something interesting online. If this pair is used for anything, somebody made a mistake. Unless Perfect Forward Secrecy was used in the communication, we don't even need MiTM since we have the private key now. We can decrypt all messages directly (provided we can capture the data of course). Moreover, we could fool the clients with our own server version and do what we want. We have to reverse engineer the software and/or the protocol though.

There is a slight chance it is a uniquely generated pair for your app instance, which is used for identify you at the server. That case attackers now can fake your identity in the Candy Crush game since you have published your private key. I don't think it is the case though, because the Subject field doesn't seems to be unique.

Regarding to your last question, yes it is certainly possible to deploy pem files with the app, since pem is a container format, it doesn't necessarily contain the private key (while the one you posted does). Distributing certificates is perfectly valid, most of the browsers do it.

  • I'm going to actually mitm the game tonight and see if I can use the key to decrypt traffic. I should have just started with that instead of speculating. – Anthony Russell Jul 17 '18 at 19:13
  • Well, it's hardly a server key, but it's your call. – goteguru Jul 18 '18 at 9:51
  • 1
    "We don't even need MiTM since we have the private key now. We can decrypt all messages directly (provided we can capture the data of course)." Note that this is only true if the connection secured by this key doesn't use forward secrecy. – Joseph Sible Jul 23 '18 at 2:24
  • 1
    @JosephSible Yes, that's true. Fixed the statement. Thanks for spotting. – goteguru Jul 23 '18 at 8:49
1

My assumption is, with the ssl.pem file, I should be able to:

-MiTM someone that is using the app -Feed the pem file to Wireshark -Decrypt and inspect all their traffic.

Is this a realistic attack? Is there something I'm missing?

If this certificate/private key pair are used for the client side of Mutual authentication in TLS then you would still need the server private key to decrypt traffic.

Mutual TLS is where the server authenticates the client after the client authenticates the server. But the traffic is still encrypted using a scheme that relies on the server private key. The private key of the client would be used to sign a challenge to confirm that the client is the certificate holder.

If the entity on the client-side of mutual TLS is an app, then the client private key and certificate need to be embedded somewhere in the app.

  • 1
    note: If the pair is used for client side auth, it must be unique (which doesn't seem to be the case) publishing it completely defeats the purpose. – goteguru Jul 17 '18 at 18:24
  • "Must" or should? Also, it's not clear to me from the post whether or not the data is unique. – hft Jul 18 '18 at 0:07
  • well, how can the same key identify anything? Of course it could identify the software itself, but if anyone can download it, what is the purpose? The pair technically may be unique (as I wrote in the answer) it just doesn't seem to be. If I'd make unique certs for my software instances I'd use unique subject (which is not the case here). I upvoted this answer though for mentioning the mutual auth, which is of course possible. – goteguru Jul 18 '18 at 9:42
  • I got you. I'm just saying that just because a developer should do something the right way doesn't mean they must do it the right way. – hft Jul 19 '18 at 4:10
  • yeah true. Humans are humans. One can find active private keys, database passwords and alike at github after all. Once I myself accidentally committed my crypto exchange access token for ~10 minutes. (No, it's not valid any more, sorry. :) – goteguru Jul 19 '18 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.