CISA Advisory: Critical Vulnerabilities in goTenna Pro ATAK Plugin

On September 26, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory detailing multiple critical vulnerabilities in the goTenna Pro ATAK Plugin, a tool designed for mesh networking communications used primarily in tactical environments. The findings raised serious concerns regarding the security posture of the plugin and were assigned a high Common Vulnerability Scoring System (CVSS) v4 score of 7.1. In this article, we'll dive into the details of the vulnerabilities identified, their potential implications for users, and recommended mitigations to safeguard against exploitation.

1. Executive Summary of Vulnerabilities​

The advisory highlights several vulnerabilities including:

• Weak Password Requirements
• Insecure Storage of Sensitive Information
• Missing Support for Integrity Check
• Cleartext Transmission of Sensitive Information
• Use of Weak Pseudo-Random Number Generator
• Weak Authentication Mechanisms
• Insertion of Sensitive Information into Sent Data
• Observable Response Discrepancy

Given the low attack complexity, these weaknesses can be exploited by attackers with minimal effort, potentially allowing them to intercept and manipulate communications.

2. Implications of Vulnerabilities​

Successful exploitation of these vulnerabilities could lead to unauthorized access to sensitive communications taking place between devices using the goTenna Pro ATAK Plugin. More alarmingly, attackers could compromise both the confidentiality and integrity of messages, possibly leading to misinformation and breaches of operational security in sensitive environments such as military operations or critical infrastructure communications.

3. Technical Breakdown of Vulnerabilities​

Each vulnerability is detailed below, along with its corresponding CVEs and CVSS scores:

3.1 Weak Password Requirements (CWE-521)​

• Description: The QR broadcast messages utilize weak passwords. If intercepted, attackers can decrypt past and future messages.
• CVEs: CVE-2024-45374
• CVSS Score: v3.1: 5.3; v4: 6.0

3.2 Insecure Storage of Sensitive Information (CWE-922)​

• Description: The plugin stores encryption keys alongside a static Initialization Vector (IV), compromising their security.
• CVEs: CVE-2024-43694
• CVSS Score: v3.1: 4.3; v4: 5.1

3.3 AES Integrity Check Lack (CWE-353)​

• Description: Absence of integrity checks on AES-CTR mode messages renders them fragile to alteration.
• CVEs: CVE-2024-43108
• CVSS Score: v3.1: 5.3; v4: 6.0

3.4 Cleartext User Transmission (CWE-319)​

• Description: User callsigns transmitted in cleartext can potentially expose identities and other vulnerabilities.
• CVEs: CVE-2024-45838
• CVSS Score: v3.1: 4.3; v4: 2.3

3.5 Weak PRNG Usage (CWE-338)​

• Description: The plugin lacks a cryptographically secure random number generator for key generation.
• CVEs: CVE-2024-45723
• CVSS Score: v3.1: 6.5; v4: 7.1

4. Recommended Mitigations​

To address these vulnerabilities, goTenna has advised users to upgrade their ATAK plugin to version 2.0.7 or later. Additional security practices include:

• Use discreet callsigns that do not disclose sensitive information.
• Secure all end-user devices, employing encryption and up-to-date software.
• Implement key rotation practices to maintain residual security.

User Advisory: Use QR codes for the safe exchange of encryption keys and ensure secure broadcasting by minimizing exposure.

5. Actionable Takeaways​

While no known public exploitation of these vulnerabilities has yet been reported, proactive measures should be adopted urgently. Organizations employing these technologies must ensure that they adhere closely to the recommended security practices.
In closing, ensuring the integrity of communication within critical missions is paramount. As cybersecurity threats continue to evolve, staying informed and vigilant is crucial. Maintain robust defenses, regularly update your systems, and foster a culture of security awareness among all users. Stay safe!
Don't hesitate to reach out to goTenna Pro Support for further guidance or questions related to the newly disclosed vulnerabilities.
Source: CISA goTenna Pro ATAK Plugin