Apps such as eHarmony & MeetMe are affected by a flaw in the Agora toolkit that went unpatched for 8 months, researchers discovered.
A vulnerability in an SDK that allows users to make video calls in apps like eHarmony, Plenty of Fish, MeetMe & Skout allows threat players to spy on private calls without the user knowing.
Security Audit
Researchers discovered the flaw, CVE-2020-25605, in a video-calling SDK from a Santa Clara, Calif.-based company called Agora while doing a security audit last year of personal robot called “temi,” which uses the toolkit.
Agora provides developer tools & building blocks for providing real-time engagement in apps, & documentation & code repositories for its SDKs are available online. Healthcare apps such as Talkspace, Practo & Dr. First’s Backline, among various others, also use the SDK for their call technology.
Could Have Impacted Millions
Due to its shared use in a number of popular apps, the flaw has the potential to affect “millions–potentially billions–of users,” reported Douglas McKee, Principal Engineer & Senior Security Researcher at McAfee Advanced Threat Research (ATR), on Wed.
McKee commented he did not find evidence of the bug is being exploited in the wild.
The flaw makes it easy for 3rd parties to access details about setting up video calls from within the SDK across various apps due to their unencrypted, cleartext transmission.
Remote Attackers
This paves the way for remote attackers to “obtain access to audio & video of any ongoing Agora video call through observation of cleartext network traffic,” according to the vulnerability’s CVE description.
Researchers reported this research to Agora.io on April 20, 2020. The flaw remained unpatched for about 8 months until Dec. 17, 2020 when the company released a new SDK, version 3.2.1, “which mitigated the vulnerability & eliminated the corresponding threat to users,” McKee suggested.
Hardcoded Key
Researchers 1st were alerted to an issue when, during their analysis of the temi ecosystem, they found a hardcoded key in the Android app that pairs with the temi robot. Upon further examination, they found a connection to the Agora SDK through “detailed logging” by developers to the Agora.io dashboard, McKee observed.
Looking at the Agora video SDK, researchers found that it allows information to be sent in plaintext across the network to initiate a video call. They then ran tests using sample apps from Agora to see if 3rd parties could leverage this scenario to spy on a user.
Circumvent Encryption
What they discovered through a series of steps is that they can, a scenario that affects various apps using the SDK, according to McKee. Further, threat players can hi-jack key details about calls being made from within apps even if encryption is enabled on the app, he commented.
The 1st step for an attacker to exploit the vulnerability is to identify the proper network traffic he or she wants to target.
50 Lines of Code
ATR achieved this by building a network layer in less than 50 lines of code using a Python framework called Scapy “to help easily identify the traffic the attacker cares about,” McKee explained.
“This was done by reviewing the video call traffic & reverse-engineering the protocol,” he explained. In this way researchers were able to sniff network traffic to gather information relating to a call of interest & then launch their own Agora video applications to join the call, “completely unnoticed by normal users,” McKee wrote.
Largely Impractical
While developers do have the option in the Agora SDK to encrypt the call, key details about the calls are still sent in plaintext, allowing attackers to acquire these values & use the ID of the associated app “to host their own calls at the cost of the app developer,” McKee explained.
However, if developers encrypt calls using the SDK, attackers cannot view video or hear audio of the call, he stated. Still, while this encryption is available, it is not widely adopted, McKee added, “making this mitigation largely impractical” for developers.
Apps Impacted
In fact, in addition to temi, researchers looked at a cross-section of apps on Google Play that use Agora – including MeetMe, Skout & Nimo TV & found that all 4 of the applications have hardcoded App IDs that allow access to call details & do not enable encryption.
“Even though the encryption functions are being called, the application developers are actually disabling the encryption based on this documentation,” McKee explained. “Without encryption enabled & the setup information passed in cleartext, an attacker can spy on a very large range of users.”
Fully Mitigate
ATR observed the company “was very receptive & responsive to receiving” information about the vulnerability, & that after testing the SDK they “can confirm it fully mitigates CVE-2020-25605.”
https://www.cybernewsgroup.co.uk/virtual-conference-march-2021/
