UvToken

The UvToken Android application logs highly sensitive wallet information such as private and public keys as well as different endpoints. By connecting an Android device to a PC, log output from the wallet application applications can be obtained with "adb logcat". It is important that applications do not send sensitive information to log output. The following screenshot shows a private key logged in the Android logcat: 

The mnemonic phrase is a list of words that can be used to recover a wallet account. Obtaining the mnemonic can potentially allow the attacker to gain full control of the wallet. The application neither has a mechanism in place to stop a user from taking the screenshot of the displayed wallet secrets nor display a warning to remind the user of the risk of taking a screenshot. 

The currently implemented password policy is permissive regarding the requirements related to the password, as it let the user set a weak password such as `Test1234`.

The application does not implement certificate pinning. Certificate pinning is the act of associating a host with its expected certificate within the application. When the application connects to the host, the stored certificate is compared to the certificate held by the remote host. If the two certificates do not match, the request is dropped. Currently, the application only verifies that the server presents a TLS certificate that is trusted by the Android or iOS trust stores, not validating that the TLS certificate is in fact the one known to be deployed on the servers.

Connections to internal hosts or testing domains such as the ones shown below were observed during the testing: ```http POST /wallet/subscription/coin HTTP/1.1 Host: 192.168.0.110:8008 Content-Type: application/json Connection: close Accept: */* User-Agent: Blockchain Wallet/1.4.1 (iPhone; iOS 14.5.1; Scale/2.00) Accept-Language: en-ES;q=1, es-ES;q=0.9 Content-Length: 1034 Accept-Encoding: gzip, deflate ``` ```http GET /v1/accounts/bi/detail/find HTTP/1.1 Host: wallet-test.uvtoken.org User-Agent: Blockchain Wallet/1.4.1 (iPhone; iOS 14.5.1; Scale/2.00) Accept: */* Accept-Language: en-ES;q=1, es-ES;q=0.9 Accept-Encoding: gzip, deflate Connection: close ``` It is believed that they were part of the testing and/or debugging process.

During the test, it was found that the HTTP response from the server contains the CORS header `Access- Control-Allow-Origin: *`.

The version of the jQuery JavaScript library used by the UvToken web service was outdated and even contained known vulnerabilities. Specifically, the version in use was 2.0.0.

The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible. As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors. PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30, 2018, except for POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits.