Chromium Browser Extension - ZKPass

1. Introduction

zkPass engaged Halborn to conduct a security assessment on their Transgate extension, beginning on 2024-08-27 and ending on 2024-09-10. The security assessment was scoped to the assets provided to the Halborn team.

2. Assessment Summary

The team at Halborn was provided two weeks for the engagement and assigned a full-time security engineer to verify the security of all the applications. The security engineer is a penetration testing expert with advanced knowledge in web, recon, discovery & infrastructure penetration testing and blockchain protocols.

- Improve the security of the implementation

- Identify potential security issues that could be affecting the implementation

During the security assessment of the extension, several vulnerabilities were identified, posing significant risks to the application’s security posture. However, these vulnerabilities have been mostly remediated through specific actions taken, such as patching, code refactoring, or security best practices from the zkPass team.

Key issues included improper input validation, excessive logging of sensitive data, and the use of outdated cryptographic practices. Input handling functions were found to inadequately sanitize user inputs, which could allow attackers to exploit injection vulnerabilities, leading to data compromise or unauthorized access. Sensitive information, including requests and responses, was logged without redaction, exposing the extension to potential data leaks.

Additionally, the use of outdated dependencies presents a major security concern, as these packages may contain known vulnerabilities that have been publicly disclosed. Furthermore, the application relies on TLS 1.2 for secure communication, which, while still supported, lacks the security enhancements provided by TLS 1.3, such as forward secrecy and reduced handshake latency. The absence of encryption for stored session data and the presence of hardcoded sensitive information further exacerbate the risks.

Addressing these vulnerabilities through package updates, implementation of secure coding practices, and adopting modern security protocols will significantly improve the extension's overall security, reducing the likelihood of exploitation and ensuring better protection of user data.

The browser extension is designed with stringent encryption standards, ensuring that all functions and transmitted data are securely protected. No risks to client data privacy were identified in our assessment, confirming that the extension maintains robust safeguards without compromising client information.