Pentesting of a Supply Chain Finance Portal and Mobile Apps for a UK Company

Summary

A UK fintech company wanted to evaluate the security of its supply chain finance web portal and the Android and iOS apps that complement it, and to find out whether they were vulnerable to outside attacks. INNERLUXES conducted black-box penetration testing, identified vulnerabilities of varying severity across the portal and mobile apps, and delivered a prioritized list of corrective measures to raise their protection level.

About the Client

The Client is a UK financial technology company providing a supply chain finance portal that brings together banks, their clients, and the clients' suppliers. The portal facilitates negotiations between clients and suppliers and the purchasing and payment processes, and gives banks an option to approve their clients' financial transactions or issue credits.

The Challenge

The Client turned to INNERLUXES to evaluate the security level of its supply chain finance portal and the mobile apps that let users reach the portal's functionality from Android and iOS devices. The Client wanted to find out whether its web portal and mobile applications were vulnerable to attacks from the outside, and commissioned black-box penetration testing.

The Solution

INNERLUXES's security testing team performed black-box penetration testing with tools compliant with the ethical hacking methodology. In the course of the testing, the engineers identified a number of vulnerabilities of different severity levels and gave the Client recommendations on how to address them:

• Strict transport security was not enforced in the web portal (low severity). The portal failed to prevent users from connecting to it over unencrypted connections, and SSL certificate verification was not ensured. By modifying a legitimate user's network traffic, attackers could use the portal as a platform for attacks against its users. INNERLUXES recommended enabling HTTP Strict Transport Security (HSTS) so the portal instructs browsers to access it only over HTTPS.
• The IIS version was disclosed in the web portal (low severity). The disclosed web-server version could help attackers understand the Client's internet information services and develop attacks targeting specific IIS versions. INNERLUXES recommended removing the IIS version information.
• The debug flag in the manifest file was enabled in the Android app (high severity). The debug flag was manually set to "true" in the manifest file, giving attackers an opportunity to connect to an open debug port and disrupt the app — potentially accessing sensitive data (banks' clients' confidential information, order details, etc.). INNERLUXES recommended disabling the debug flag.
• Certificate pinning was missing in the Android and iOS apps (medium severity). SSL certificate pinning checks the validity of the certificate used to encrypt data; without it, an attacker able to generate a valid certificate for the target domain could access the portal and decrypt traffic, risking a leak of confidential data. INNERLUXES recommended enabling certificate pinning for the Android and iOS apps.

The Results

• The Client received an assessment of the security level of its web portal and complementing Android and iOS apps.
• The penetration testing identified several vulnerabilities across the portal and mobile applications.
• The Client got a list of corrective measures aimed at increasing the protection level of its web portal and mobile applications.

Technologies and Tools

Metasploit, Nmap, SQLMap, Nikto, DIRB, Burp Suite, Nessus, ZMap.