End-to-what?

Evaluation on E2EE-ness of ProtonMail service based on some incident, independently discovering a fundamental flaw. (OWASP Saitama MTG #4, talk #1)

Transcript

1. END-TO-WHAT? 28.9.2021 OWASP SAITAMA MTG #4
2. TEXT SESSION FLAGS ▸ ࿥Իɾ࿥ըɾ಺༰ެ։: OK
3. TEXT WHO I AM ▸ Takahiro Yoshimura (@alterakey) https://keybase.io/alterakey ▸ Monolith Works Inc. Co-founder, CTO Security researcher
4. TEXT WHAT I DO ▸ Security research and development ▸ iOS/Android Apps →Financial, Games, IoT related, etc. (>200) →trueseeing: Non-decompiling Android Application Vulnerability Scanner [2017] ▸ Windows/Mac/Web/HTML5 Apps →POS, RAD tools etc. ▸ Network/Web penetration testing →PCI-DSS etc. ▸ Search engine reconnaissance (aka. Google Hacking) ▸ Whitebox testing ▸ Forensic analysis
5. TEXT WHAT I DO ▸ CTF ▸ Enemy10, Sutegoma2 ▸ METI CTFCJ 2012 Qual.: Won ▸ METI CTFCJ 2012: 3rd ▸ DEF CON 21 CTF: 6th ▸ DEF CON 22 OpenCTF: 4th ▸ ൃදɾߨԋͳͲ DEF CON 25 Demo Labs (2017) DEF CON 27 AI Village (2019) CODE BLUE (2017, 2019) CYDEF (2020) etc. DEFCON 2016 by Wiyre Media on flickr, CC-BY 2.0
6. TEXT BACKGROUND ▸ ProtonMail: ϓϥΠόγʔอޢΛ༏ઌͨ͠ϝʔϧ αʔϏε ▸ ಺༰อޢ: ௨৴҉߸Խ, σʔλ҉߸Խ ▸ ར༻ऀอޢ: ϩάෆอ࣋, ੓࣏తಠཱੑ ▸ Tor͔Β΋઀ଓՄೳ ▸ ׆ಈՈͳͲʹ࢖ΘΕ͍ͯΔ
7. TEXT BACKGROUND ▸ ϑϥϯεਓ׆ಈՈͷୁั ▸ Youth for ClimateͷParis Chapter͕ॴ༗ ▸ IPϩάͷఏڙ →EuropolΛ௨ͨ͠ϑϥϯε౰ہͷಇ͖͔͚ʹ ΑΓɺεΠε౰ہ͔Β։໋ࣔྩ͕ߦͬͨ ▸ ୯ͳΔݐ෺઎ڌࣄ݅ɺ͕ͩ →ݏٙ͸ςϩ४උ͋ͨΓͩͬͨͷͰ͸ - Le Petit Cambodge: աڈʹ߈ܸ͞Ε͍ͯΔ - ෳ਺ͷarachistϑΥʔϥϜ΁ͷॻ͖ࠐΈ
8. TEXT BACKGROUND ▸ ProtonMailͷ҆શੑʹٙ໰͕ఄ͞Εͨ ▸ ͪͳΈʹಁ໌ੑϨϙʔτʹهࡌͳ͠ (https://protonmail.com/blog/transparency- report/) ▸ ϝʔϧ͕ಡ·ΕΔ͜ͱ͸ͳ͍ͷ͔ʁ →҉߸ܥ (esp. E2EE) ͷհࡏΛࠜڌʹ൱ఆ (https://protonmail.com/blog/climate- activist-arrest/)
9. TEXT BACKGROUND: E2EE ▸ E2EE: End-to-End Encryption ▸ αʔϏεఏڙऀ͕ϢʔβͷσʔλΛղಡෆೳͱ ͢Δ҉߸ܥઃܭ ▸ σʔλʹର͢Δ੹೚Λܰݮ͢ΔޮՌ
10. TEXT RELATED WORKS ▸ ProtonMail͕ఏڙ͢ΔE2EEͷҰ෦͕ഁ୼͍ͯ͠ Δͱͷݚڀ (Nadim Kobeissi, 2018) ▸ Webmailʹ͓͍ͯ ▸ JSʹΑΔ҉߸ܥϩδοΫͷఏڙ →αʔόԚછʹΑΓಁաతʹ߈ܸՄ ▸ ൿີ伴ͷड͚౉͠
11. TEXT PROBLEM ▸ ProtonMail͸ຊ౰ʹ҆શͳͷ͔ʁ ▸ ࠓ͸Ͳ͏ͳͷ͔ʁ ▸ WebmailҎ֎͸Ͳ͏ͳͷ͔ʁ
12. TEXT AUTH/AUTHZ: SRP/OAUTH2. ▸ SRPʹΑΔZero-knowledge password proof
13. TEXT CRYPTOGRAPHY STACKS.. ▸ OpenPGP.js 4.10.10 ▸ Veri fi ed: sha384 ▸ ProtonMail͕؅ཧ͍ͯ͠Δ
14. TEXT ...LONG-TERM KEYPAIRS? ▸ PGP keypairs ▸ Public keys ▸ Private keys ▸ ηογϣϯมԽʹରͯ҆͠ఆ ▸ Ұ࣌తΩʔϖΞͰ͸ͳ͍ ʢఆٛతʹ΋อޢ͕੒ཱ͠ͳ͍ʣ
15. TEXT BUSTED! ▸ E2EE͸࣮֬ʹഁ୼ ▸ ߃ৗతΩʔϖΞΛ౉͍ͯ͠Δ ▸ อ؅͍ͯ͠Δূࠨ ▸ શϝʔϧͷ෮߸ɾॺِ໊଄Մೳ
16. TEXT REMEDY I: SHROUDING KEYPAIRS ▸ ൿີ伴ΛΫϥΠΞϯτଆͰੜ੒ɺผ్ύεϫʔ υͰ҉߸Խ͠ɺαʔό΁อଘ ▸ ϩάΠϯ࣌ʹղಡͷඞཁ͕ग़Δ ▸ ύεϫʔυΛ๨ΕΔͱ٧Ή
17. TEXT REMEDY II: ESTABLISHING TRUST ANCHERS ▸ ϥΠϒϥϦ։ൃݩͱαʔϏαʔ͸ผͰ͋Δ΂͖ ▸ Ͱ͖Ε͹҉߸ܥΛJSͰ࣮૷͠ͳ͍ ʢPGP͕ඞཁͳͷͰෆՄೳʹ͍͕ۙʣ ▸ WebCrypto API etc.
18. TEXT WHAT ABOUT ... THEIR APPS? ▸ (This is left as an exercise for the reader.)
19. TEXT WHAT ABOUT ... THEIR APPS? ▸ (This is left as an exercise for the reader.) ▸ …ͨͩͷ࣌ؒ੾ΕͰ͢
20. TEXT AFTERTHOUGHTS ▸ ProtonMail͸εΠε๏ʹͷΈै͏ͱ͍ͯ͠Δ ▸ MLAT (ܐࣄڞॿ৚໿) ʹΑΓถࠃ੓෎ͱڠྗؔ܎ ▸ CIA/NSAͳͲͷཁ੥ʹैͬͯ։ࣔ͢ΔՄೳੑ ▸ ࣮຿্͸EuropolͳͲLEAؒ࿈ܞ͕ଟ༻ ▸ ߳ߓ΋Ճໍ͍ͯ͠Δ
21. TEXT AFTERTHOUGHTS ▸ ProtonMail͸IPϩάΛऔ͍ͬͯͳ͍ͱ͔ͭͯެݴ →ࣄ݅Ҏ߱هࡌ͕མͪͨ ▸ ߃ৗతϩά͸࣋ͨͳ͍ͱҾ͖ଓ͖ݴ͍ͬͯΔ →Ұ࣌ϩά͸͍࣋ͬͯΔ (IP Logging, https://protonmail.com/privacy- policy)
22. TEXT AFTERTHOUGHTS ▸ ProtonVPN͸ϩάΛऔΔͷ͔ʁ ▸ औΒͳ͍ɺϝʔϧͱ͸ҧ͏ͷͰ๏తʹ΋औಘΛ ໋ྩ͢Δ͜ͱ͸Ͱ͖ͳ͍ͱ͍ͯ͠Δ͕… ▸ ͪͳΈʹ߈ܸߦҝͳͲΛͨ͠৔߹͸ban͞ΕΔ͕ ௨৴಺༰ͷϦΞϧλΠϜղੳʹΑΔͱ͍ͯ͠Δ (https://www.reddit.com/r/ProtonVPN/ comments/93pp40/ protonvpn_does_keeping_logs/)
23. TEXT TAKEAWAYS ▸ ProtonMail: E2EE͸࣮֬ʹഁ୼ ▸ ࠓͰ΋߃ৗతΩʔϖΞΛ౉͍ͯ͠Δ →ProtonଆͰอ؅͍ͯ͠Δূࠨ →͜Ε͚ͩͰഁ୼
24. TEXT TAKEAWAYS ▸ Proton*: ϓϥΠόγʔอޢೳྗʹ͸ٙ໰ ▸ εΠεͷMLAT΁ͷՃໍ (ୈҰ߸) ▸ CIA/NSAͳͲͷཁٻʹԠ͡։ࣔ͢ΔՄೳੑ ▸ IPϩά (*Mail), τϥϑΟοΫղੳ (*VPN) ▸ ᐆດͳઆ໌
25. TEXT TAKEAWAYS ▸ ո͍͜͠ͱΛ͢Δʹ͸ଟ෼޲͔ͳ͍ ▸ Clearwebͷ΄΅ݶքɺ͋ͱ͸Darkweb΁… "Welcome to the real world." -- Morpheus, The Matrix
26. FIN.