---------------------------------------------------------------- v1 -

modzero  Security  Advisory:  Insecure application-coupling  in  Good
Authentication Delegation [MZ-15-03]

---------------------------------------------------------------------

---------------------------------------------------------------------

1. Timeline

---------------------------------------------------------------------

 * 2015-08-18: Vulnerability has been discovered
 * 2015-09-09: Vendor contact to agree on responsible disclosure
 * 2015-09-25: Public Disclosure.

---------------------------------------------------------------------

2. Summary

---------------------------------------------------------------------

Vendor: Good Technology, Inc.
Products known to be affected:
 * Combination of Android Good Dynamics SDK version 1.11.1206
   Android Good Access app version 2.3.1.626
   Android Good for Enterprise app version 3.0.0.415
   Good Control server version 1.10.47.31
   Good Proxy server version 1.10.47.2
   Good for Enterprise server version 7.2.2.5c
 * Other products, versions and apps using authentication-delegation
   may be affected as well.
Severity: Medium/High

The  Good Mobile  Device  Management solution  provides two  separate
Android  applications,  Good  for  Enterprise [1]  (a  mobile  device
management Android application with functionality such as E-Mail) and
Good   Access  [2]   (an   Android  application   that  has   similar
functionality as  a regular  browser app  to access  company intranet
servers). Both  apps use  the underlying  Good Dynamics  framework to
communicate with  the Good server  located in the  customer's company
network.

Authentication delegation  is a method  to provision the  Good Access
Android app by using the Good  for Enterprise Android app. Using this
mechanism, an employee does not  need to manually enter an activation
key to  provision the  Good Access  app, if  Good for  Enterprise was
already provisioned before.

Third-party apps can  spoof their identity and try  to request access
to company  servers and  data. Users could  be tricked  into allowing
access to  company intranet servers to  a faked Good Access  app. The
server  administrator   is  not  able   to  prevent  or   detect  the
unauthorized access.

A CVE has not yet been assigned to this vulnerability.

---------------------------------------------------------------------

3. Details

---------------------------------------------------------------------

As a  precondition for this  vulnerability, the Good servers  have to
allow access to intranet servers on  the company network via the Good
Access app. It is also  necessary to enable authentication delegation
through Good for Enterprise.

A  specially  crafted third-party  Android  app  can use  an  Android
package  name  that starts  with  "com.good.gdgma"  (the Good  Access
package name). Subsequently the app is able to announce itself as the
Good Access app to the authentication delegate (Good for Enterprise).
The user of the Android device has to explicitly grant access to this
third-party app  [3], even  though the specially  crafted application
might be indistinguishable from the legitimate  app for a user. It is
possible to activate not only one, but several faked apps through the
authentication  delegate (Good  for  Enterprise)  by using  different
package  names (e.g.  "com.good.gdgma.test1", "com.good.gdgma.test2",
etc.).

The Good Dynamics server administrator  can not distinguish between a
malicious third-party  app and  the legitimate app  accessing company
data, as  the provisioned app  in the  Good backend web  interface is
showing that Good Access was provisioned.

As  a  mitigation the  Good  for  Enterprise  app could  protect  its
authentication-delegation-API intent (Android IPC mechanism) with the
signature level  protection provided by the  Android operating system
(android:protectionLevel="signature"). Only apps signed with the same
private key can use such permissions.

---------------------------------------------------------------------

4. Impact

---------------------------------------------------------------------

After tricking  a user  into installing  a modified  application that
pretends  to  be  a  Good   Access  app  towards  the  authentication
delegation mechanism, the missing  authentication can be exploited to
gain access to the intranet  data via the Good servers. Additionally,
other   third-party  apps   could   request   permission  to   access
company-data from  the user  - the Good  server administrator  is not
able to prevent usage of such third-party apps.

---------------------------------------------------------------------

5. Proof of concept exploit

---------------------------------------------------------------------

As a  proof of concept, an  example app of the  Good Dynamics Android
SDK can  be used.  modzero used  the ApacheHttp  example application.
After  loading the  example project  in the  Android Studio  IDE, the
GDApplicationID variable in the included settings.json file has to be
changed  to "com.good.gdgma".  Additionally the  package name  in the
AndroidManifest.xml file must be changed  to a value that starts with
"com.good.gdgma". The included classes have to be refactored to match
the new  package name. After  installing the example  application and
clicking  the  button  to  use authentication  delegation,  Good  for
Enterprise will  show the  dialog to confirm  access to  company data
[3]. If  the user enters  his Good  for Enterprise app  password, the
malicious application is allowed to access intranet servers [4].

An alternative  to demonstrate the  issue is probably  to disassemble
the  Good Access  app  via apktool  [5], add  malicious  code to  the
application and reassemble the app via apktool.

---------------------------------------------------------------------

6. Workaround

---------------------------------------------------------------------

Users can deactivate authentication  delegation and revoke access for
Good Access. Another workaround is not known.

---------------------------------------------------------------------

7. Fix

---------------------------------------------------------------------

It is not known to modzero, if a security fix is available.

---------------------------------------------------------------------

8. References

---------------------------------------------------------------------

[1] https://play.google.com/store/apps/details?id=com.good.android.gfe
[2] https://play.google.com/store/apps/details?id=com.good.gdgma
[3] http://www.modzero.ch/advisories/media/good_dynamics_provisioning.png
[4] http://www.modzero.ch/advisories/media/good_dynamics_usage.png
[5] https://ibotpeaches.github.io/Apktool/

---------------------------------------------------------------------

9. Credits

---------------------------------------------------------------------

 * Tobias Ospelt

---------------------------------------------------------------------

10. About modzero

---------------------------------------------------------------------

The  independent  Swiss  company  modzero  AG  assists  clients  with
security analysis  in the complex  areas of computer  technology. The
focus  lies  on  highly  detailed  technical  analysis  of  concepts,
software  and  hardware components  as  well  as the  development  of
individual solutions.  Colleagues at  modzero AG work  exclusively in
practical, highly  technical computer-security areas and  can draw on
decades  of experience  in  various platforms,  system concepts,  and
designs.

https://www.modzero.ch

contact@modzero.ch

---------------------------------------------------------------------

11. Disclaimer

---------------------------------------------------------------------

The information  in the advisory  is believed  to be accurate  at the
time of publishing  based on currently available  information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with  regard to this information. Neither the
author  nor  the publisher  accepts  any  liability for  any  direct,
indirect, or  consequential loss  or damage arising  from use  of, or
reliance on, this information.