mailing list archives
Re: Android HTC Mail insecure password management
From: Jeffrey Walton <noloader () gmail com>
Date: Wed, 8 Aug 2012 00:06:47 -0500
What was HTC's response?
What were the results under Android 4.0+ (Ice Cream Sandwich)? Were
you able to test the configuration?
Android 4.0+ offers a Keychain, and applications should be storing
base secrets in the Keychain (pushing the responsibility from
developer to OS).
On Sun, Aug 5, 2012 at 2:57 PM, <vtalk () hexview com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Android HTC Mail insecure password management
HTC is $9.5B(USD) Taiwanese manufacturer of smartphones and tablets, primarily
Android-based. HTC's devices account for 5% of the smartphone market and for
about 15% of all Android devices sold in the US. Most HTC devices come with an
application called HTC Mail. HexView discovered that HTC Mail insecurely stores
HTC Mail application, all versions (package: com.htc.android.mail)
Android OS comes with a feature called AccountManager that lets applications
manage user credentials in a more or less secure fashion. HTC Mail instead stores
usernames and passwords directly in its database obfuscated with a weak, trivial
to reverse algorithm.
HTC Mail application stores user credentials in the 'accounts' table in its 'mail.db'
SQLite database. The table contains usernames, email addresses, hostnames, mailbox
and SMTP passwords for each mail account configured in the Mail application. All data
is stored in a plain text except for passwords that are "encrypted" as follows:
1. Password characters at odd and even positions are swapped.
2. The byteswapped string is base-64 encoded twice.
3. The resulting base64-encoded password is stored in the database.
HexView produced a script for the GameSpector application (available in Google Play)
that decodes and displays HTC mail passwords. GameSpector requires root access.
This document may be freely distributed through any channels as long as
its content is kept intact. Commercial use of the information in the
document is not allowed without written permission from HexView.
Please direct all questions to vtalk () hexview com
HexView is a technology consulting boutique offering a variety of information
security services, including security assessments of mobile applications.
For more information visit http://www.hexview.com
Feedback and comments:
Feedback and questions about this disclosure are welcome at vtalk () hexview com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/