VTech DigiGo 83.60630 Certificate Pinning

Details: Written by: khalil shreateh; Category: Vulnerabilities; Hits: 414

------------------------------------------------------------------------
Broken TLS certificate pinning in VTech DigiGo Kid Connect app
------------------------------------------------------ ------------------------------------------------------------------------
Broken TLS certificate pinning in VTech DigiGo Kid Connect app
------------------------------------------------------------------------
Sipke Mellema, September 2017

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
VTech's DigiGo is a hand held smart device for children. The device
contains a chat application chatting with friends and family, called Kid
Connect. The app has a broken certificate pinning implementation that
allows a man in the middle attack on text sent by the chat app.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was tested on a VTech DigiGo running firmware version
83.60630. It is likely that other versions are also affected.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
VTech pushed a firmware update to address this issue on 6 November,
2017. The firmware version still displays as 83.60630.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2017/broken-tls-certificate-pinning-in-vtech-digigo-kid-connect-app.html

Kid Connect uses the Jabber protocol, and certificate pinning is used an extra security layer in its TLS traffic. Research indicated that the app implements pinning on the following domains:

www.vtechda.com
kc-web.vtechda.com
kc-proxy.vtechda.com

Above domains don't include all domains that the app uses to communicate. The domain kc-im8.vtechda.com is used for authentication and sending text messages. This domain is not pinned, and the device doesn't seem to validate TLS certificates for domains not in the pinning list. An attacker can perform a man in the middle attack on the chat app and hijack the authentication procedure and text messages.