CVE-2025-11645

Executive Summary

CVE-2025-11645 is a low-severity vulnerability in the Tomofun Furbo mobile application for Android, up to version 7.57.0a. The flaw resides in the Authentication Token Handler component, which insecurely stores sensitive authentication tokens on the device. An attacker with physical access to the device can extract these tokens, potentially gaining unauthorized access to the Furbo camera and associated services. The vendor has not responded to disclosure attempts, and no official patch is available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild, but the public availability of exploit details increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary Android application vulnerability. No supply chain implications are identified.

CVSS Breakdown & Threat Level

CVSS Score: 2.4 (Low) Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Physical (AV:P) – The attacker must have physical access to the unlocked device.
• Attack Complexity (AC): Low (AC:L) – No special conditions or mitigations are required.
• Privileges Required (PR): None (PR:N) – No authentication is needed to exploit.
• User Interaction (UI): None (UI:N) – The victim does not need to perform any action.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (C:L) – Only authentication tokens are exposed, not full data.
• Integrity (I): None (I:N) – No data modification is possible.
• Availability (A): None (A:N) – No denial of service.

Threat Level: Low. The requirement for physical access significantly limits the attack surface. However, the public disclosure of the exploit method increases the risk for targeted attacks against specific individuals.

Deep Dive & Mechanics

The vulnerability is rooted in the Android application's handling of authentication tokens. The Furbo app likely stores a session token or API key locally to maintain user login state. Instead of using secure storage mechanisms like the Android Keystore or encrypted SharedPreferences, the application stores the token in an insecure location, such as:

• Plaintext in SharedPreferences
• Unencrypted in a local database (e.g., SQLite)
• In a world-readable file in the app's internal storage

An attacker with physical access to the device can use ADB (Android Debug Bridge) or a file explorer to navigate to the app's data directory (/data/data/com.tomofun.furbo/) and extract the token. The token can then be used to impersonate the user and access the Furbo camera feed, change settings, or perform other actions via the Furbo API.

The exploit does not require root access if the device is unlocked and USB debugging is enabled, or if the attacker can access the device's file system through other means (e.g., backup extraction).

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would use the Android Keystore to encrypt the token and store it in a private, encrypted file. Below is an example of vulnerable vs. patched code.

Vulnerable Code (Java/Kotlin):

// Insecure storage in SharedPreferences
SharedPreferences prefs = getSharedPreferences("furbo_prefs", MODE_PRIVATE);
prefs.edit().putString("auth_token", token).apply();

Patched Code (Java/Kotlin):

// Secure storage using Android Keystore
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
keyGenerator.init(new KeyGenParameterSpec.Builder("furbo_key", KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
        .build());
SecretKey key = keyGenerator.generateKey();

Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key);
byte[] iv = cipher.getIV();
byte[] encryptedToken = cipher.doFinal(token.getBytes());

// Store encrypted token and IV
SharedPreferences prefs = getSharedPreferences("furbo_prefs", MODE_PRIVATE);
prefs.edit().putString("encrypted_token", Base64.encodeToString(encryptedToken, Base64.DEFAULT)).apply();
prefs.edit().putString("iv", Base64.encodeToString(iv, Base64.DEFAULT)).apply();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to an unlocked Android device with Furbo app installed (version <= 7.57.0a).
• USB debugging enabled on the device (or ability to enable it).
• ADB installed on the attacker's machine.

Steps:

1. Connect the device to the attacker's machine via USB.
2. Verify device connection: adb devices
3. Navigate to the app's data directory: adb shell
4. List files in the app's directory: run-as com.tomofun.furbo ls /data/data/com.tomofun.furbo/
5. Extract the token from SharedPreferences: adb shell run-as com.tomofun.furbo cat /data/data/com.tomofun.furbo/shared_prefs/furbo_prefs.xml
6. Look for a key like auth_token or token. The value is the authentication token.
7. Use the token to access the Furbo API (e.g., via curl or a custom script):

   curl -H "Authorization: Bearer <token>" https://api.furbo.com/v1/camera/feed
   

Alternative Method (without ADB):

• Use a file manager app on the device (if allowed) to navigate to /data/data/com.tomofun.furbo/ and copy the file.

Blue Team

Detection:

• Monitor for unauthorized physical access to devices.
• Use Mobile Device Management (MDM) solutions to enforce device encryption and disable USB debugging.
• Implement app-level security controls to detect file system access.

Prevention:

• Ensure the app is updated to the latest version (if a patch becomes available).
• Use Android Enterprise features to restrict app data access.
• Educate users to keep their devices locked and not to grant USB debugging access to untrusted parties.

Response:

• If a token is compromised, revoke it immediately via the Furbo backend (if possible).
• Force logout of all sessions.
• Change the Furbo account password.

Indicators of Compromise (IOCs)

• File Path: /data/data/com.tomofun.furbo/shared_prefs/furbo_prefs.xml
• File Content Pattern: auth_token or token key with a base64 or plaintext value.
• Network Traffic: Unusual API calls to api.furbo.com with a token that does not match the user's current session.
• Process: adb or run-as commands executed on the device.

Detection Engineering

YARA Rule

rule furbo_token_exfiltration {
    meta:
        description = "Detects extraction of Furbo authentication token from SharedPreferences"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11645"
    strings:
        $token_key = "auth_token" nocase
        $token_key2 = "token" nocase
        $prefs_file = "furbo_prefs.xml"
    condition:
        $prefs_file and ($token_key or $token_key2)
}

Sigma Rule

title: Furbo Authentication Token Extraction
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to read Furbo app's SharedPreferences file containing authentication tokens.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/adb'
        CommandLine|contains: 'run-as com.tomofun.furbo'
    condition: selection
falsepositives:
    - Legitimate debugging by the app developer
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Furbo API Token Abuse"; flow:to_server,established; content:"Authorization"; nocase; http_header; content:"Bearer "; distance:0; within:100; http_header; pcre:"/Bearer\s+[A-Za-z0-9+/=]{20,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical Security: Ensure devices are locked when unattended. Disable USB debugging on production devices.
2. Token Rotation: If possible, rotate the Furbo account password and revoke all existing tokens via the Furbo web interface.
3. App Update: Monitor for an official patch from Tomofun. If none is available, consider using a third-party security wrapper or MDM to restrict app data access.

Long-Term Fixes:

• The vendor should implement secure token storage using Android Keystore or EncryptedSharedPreferences.
• The app should use biometric authentication or device PIN to access stored tokens.
• Implement token expiration and refresh mechanisms to limit the window of exposure.

Workarounds:

• Use Android's "Work Profile" to sandbox the app.
• Encrypt the device with a strong password (this does not prevent extraction if the device is unlocked).

Valters IT
Securing Digital Frontiers