The hidden costs of parental control apps

Introduction

Nowadays, children have access to smartphones or tablets at an early age or already possess their own devices. To block and control access to potentially harmful or non-child-friendly content or restrict usage times, parents often install parental control apps on the children's devices. The goal of this infosec research was to find out whether the apps' users are properly separated from each other in order to prevent unauthorized third parties accessing their data or devices. Moreover, we wanted to find out which and how much data is being collected and stored by these apps in general.

We examined the information stored on the device and at the app provider (e.g. cloud storage) and paid close attention to the features that enable parental management of the child device. We investigated if it was possible to circumvent authorization checks so that remote or local attackers could access features of the child devices or gain access to personal information of other users of those applications.

This blog post describes which apps were looked at, the methodology used to analyze the apps and the identified vulnerability classes. As mentioned above, we currently won’t provide detailed technical information, because some applications are still vulnerable to those attacks and some issues might not be easily resolved.

Overview of analyzed apps

The following table lists the apps which have been briefly analyzed, based on the methodology mentioned below. The scope of this research is restricted to parental control apps for the Android mobile platform and no full security review has been performed for any of these apps. The download and version information from the table below has been taken from the Google Play store. The information regarding available privacy policy, imprint and the location of the vendors' headquarters have been found on their respective websites. 

We also noticed that many of these apps have a flag set for allowing plain text connections (android:usesCleartextTraffic="true"). This flag enables the application to use unencrypted communication, which an attacker on the same network can easily gain access to. For example, a simple man-in-the-middle attack could be used to sniff user credentials or other PII data. But since all of the tested apps have employed transport layer encryption (TLS), it is unclear why this flag was set, as this gives developers the option to send unencrypted requests.

Next, we checked if there are any hard-coded credentials to be found in the source code which might allow an attacker to perform further attacks. All identified API keys were checked against the possibility of misuse due to a lack of API key restrictions.

Dynamic Analysis

For the dynamic analysis, we installed the apps on physical, rooted test devices: Google Pixel 4a with Android 11

After registering and playing around with the respective apps, we manually checked the internal memory using ADB. After determining which data is stored on the device, we tried intercepting the traffic to see where data is being sent and which data is being collected in the first place.

Some of the analyzed apps had security measures like certificate pinning in place (a measure against man-in-the-middle sniffing attacks), but all of them could easily be circumvented by using the Universal SSL Pinning Bypass script for Frida. This enabled us to further analyze the API calls of the applications to their cloud servers using proxy tools such as Burp Suite and to check whether attackers could access data of other users/children (in this case our own test devices), e.g. through insecure direct object references.

The table above shows the amount of identified vulnerabilities for each app. As mentioned, we won't publish any further details as long as the vulnerabilities have not been fixed by the vendors. Please keep in mind, that the security checks were timely limited for each app and no detailed security review was performed. An app having only one (currently known) security issue does not render that app more secure than an app with two issues.

Samsung KNOX remarks

During our research, we briefly had the opportunity to check out a Samsung Galaxy S9 device of a child and a Samsung Galaxy S22 Ultra as the parent device. Thanks to Samsung KNOX, one of the tested parental control apps (Boomerang), that was installed on this device, allowed an even more fine-grained approach to set security restrictions. It could be verified that if Samsung KNOX is available on the phone, a parent could disable shutting down the phone or booting into safe mode. Further research was not performed regarding other available Samsung KNOX features, nor was Samsung KNOX in scope of this review but it could be verified that the “Safe mode” bypass mentioned above could not be exploited on this device.

The following table lists all identified 3rd party domains or servers that are being contacted upon using the web dashboards or websites of the vendor. This list is not necessarily complete and also may change in the future. It is noticeable that nearly all use some sort of tracking services.

Also try to verify how the vendor reacts upon security vulnerabilities. In our case, some of the vendors started working on a fix as soon as they were contacted by us, some did not even answer properly until today. We always add information about the communication in the timeline of our security advisories. This might help you to determine if they seem to have mature vulnerability handling processes (such as described in ISO/IEC 30111:2019) or (ideally) an information security management system (ISMS) in place.

We also recommend looking at parental control features native to the operating system (OS), like Google's Family Link for Android or Apple's Family Sharing for iOS. These are tightly integrated into the operating system and do not allow simple bypasses via safe mode like described above. From our short look at Google's Family link, it seems that a lot of thorough thought went into designing these features, especially regarding children's consent and the right to privacy.

However, we did not perform a detailed analysis of these native OS features during this research, but it is on our to-do list for the future. 

Most importantly, parents should always inform their children about the use of any software on their devices and explain why those tools are implemented and which surveillance features are being used by the parents.

Conclusion

Child safety apps may not be that safe after all. Children may consent to their parents having a look at their activities on their smartphones, but their privacy remains at risk as long as it is uncertain how software vendors store the data or who else might gain access at a later date. Security vulnerabilities raise even more privacy concerns. Eventually, creative children might even be able to bypass the restrictions and escape the surveillance nanny by themselves.

Christmas is right around the corner and many children are likely to receive mobile phones or tablets as a gift. Therefore, it is important for parents to carefully consider their choice of the parental control app from a security, privacy or legal point of view and have a conversation with their child about its use.

Timeline

This research project has been conducted by Fabian Densborn and Bernhard Gründling from August to November 2022. The vendors of certain apps have been contacted through our responsible disclosure process and informed about the identified vulnerabilities. Some have already started to work on a patch. After the responsible disclosure phase is completed and the vulnerabilities have been fixed, SEC Consult will publish the respective security advisories with more technical details.

This research has been conducted by Fabian Densborn and Bernhard Gründling and published on behalf of the SEC Consult Vulnerability Lab.
SEC Consult is always searching for talented security professionals to work in our team. More information can be found at: https://www.sec-consult.com/career