A Canadian programmer has published what he claims is a vulnerability in Coinbase’s Android apps, one that could allow an attacker to gain full access to a user’s account.
Software Engineer Bryan Stern went so far as to caution users not to use the Coinbase Bitcoin Wallet and Merchant apps for Android until the problem is fixed, and advised them to check their accounts for suspicious activity.
However, the company has since responded to Stern in a reddit thread stating that the vulnerabilities were not as serious as Stern claims.
Stern, who works on Android development at Hootsuite, said he’d brought the issue to Coinbase’s attention via their ‘white hat’ bug bounty program in early March, but there had been a disagreement over the seriousness of the issue.
Upon finding his issue present in the latest version of the app, he decided to release the information publicly on 27th June in the hope that prompt action would be taken.
He wrote:
“I don’t mean any harm posting this, but I am frustrated that some security fixes that might require maybe 20 [development] hours to implement and is allegedly on the roadmap 3 months ago has not yet been addressed.”
The issue at hand
A lower level of security in the Android apps could allow eavesdroppers to launch a ‘man in the middle’ (MITM) attack against users, Stern said. He wrote in his report:
“Coinbase wisely recommends that all clients of their API should validate the SSL certificate presented to prevent MITM attacks. However, they fail to do this in their own Android applications.”
Thanks to this, an attacker could present a ‘spoofed’ SSL certificate (anything with a valid signature but from a different signing authority to the one Coinbase uses) and intercept communications.
The client_id and client_secret items, part of the application’s API that should be secret, are in clear view in Coinbase’s source code published on GitHub, Stern continued. These would then be revealed during a user’s authentication process and provide a hacker with the all-important access_token.
With an attack established, plus this stolen token, a malicious hacker could make API requests at a later time on the user’s behalf – essentially taking full control over their account.
Stern recommended Coinbase change client_id and client_secret and keep them confidential in future. He also recommended all apps validate SSL connections properly, and that they make use of the Coinbase API’s improved authentication process and stop using the deprecated one.
Coinbase said the threat was a minor one only, and an attack could only be performed successfully under a specific, but unlikely, set of circumstances.
Client_id and client_secret were intended to be public and not defenses against hack attacks, a company representative said, and while SSL Pinning might help against some attacks, it was not a defense against all malware or local modification of certificates.
Bug bounty program
After having his claims initially rejected by Coinbase on 14th March, Stern then wrote a draft blog post warning the public about the issue and sent it to the company in April.
This too was rejected, so he opened a report on HackerOne, a site where ethical hackers dissatisfied with existing bounty programs can disclose vulnerabilities privately.
Coinbase paid Stern $100 but said it would not be fixing the issue, leading HackerOne to make the report public. When he found the issue still not fixed in the latest version (2.2) of Coinbase’s apps, Stern decided to publish the report on his blog.
Coinbase’s bug bounty program pays a minimum $1,000 in bitcoin to anyone who can find a valid security hole in its code, but the company “reserves the right to decide if the minimum severity threshold is met”.
The company in April responded to claims in March that its ‘Request Money’ feature left users vulnerable to phishing attempts. The feature allowed a user to find out if an email address was attached to a Coinbase account by entering it into a search field.
Image via watcharakun / Shutterstock