search

android-password-store / Android-Password-Store

Android application compatible with ZX2C4's Pass command line application
https://passwordstore.app
GNU General Public License v3.0
2.53k stars 251 forks source link

Fix application crash when disabling cache auto-clear option and potential attack vector #3136

Closed agrahn closed 1 month ago

agrahn commented 1 month ago

When disabling the passphrase cache auto-clear setting, the cache needs to be cleared once in order to prevent a malicious user (someone knowing the screen-lock pin but not knowing the correct passphrase) from bypassing the auto-clearing after waking up/unlocking the device, followed by disabling the auto-clearing option in the settings.

However, clearing EncryptedSharedPreferences requires authentication, otherwise the app crashes. Currently, a crash can be provoked as follows:

  1. Open APS, make sure that passphrase caching and auto-clear option are both enabled.
  2. Decrypt some entry in the store with the correct passphrase.
  3. Switch off the screen.
  4. Unlock the device again and keep it awake for one minute or two by doing something within another app, e.g. browsing the internet.
  5. Switch to APS, go directly to the PGP settings screen and disable the auto-clear option.
  6. APS crashes and immediately reloads automatically.

APS crashes because the user authentication has expired in the meantime and clearing the passphrase from EncryptedSharedPreferences is attempted.

After the crash, the auto-clear option is disabled but the passphrase is still present in the cache. From now, the bad user is given access to any store entry by just entering the correct screen-lock pin, without the need to also enter the PGP passphrase. In this way, that user successfully bypassed and disabled the cache auto-clearing.

This PR

  1. restores BiometricAuthenticator before clearing the passphrase from EncryptedSharedPreferences. This prevents app crashing
  2. enforces the auto-clearing option to stay enabled in the case of failed authentication (caused by dismissing the authentication dialog). This prevents the attempt of bypassing cache auto-clearing.