Slovensko.Digital

Assignment

Slovensko.Digital commissioned us to test the security of Autogram, an application that enables users to electronically sign documents on both computers and mobile devices. The testing consisted of two parts. We tested the desktop client according to the OWASP Thick Client Security methodology and then conducted a penetration test of the mobile application and its server-side components according to the OWASP Mobile Top 10 methodology. Since Autogram performs cryptographic operations with legal implications, we focused primarily on data confidentiality, application integrity during runtime, and the resilience of communication between services.

Our solution

During the testing, we combined automated tools with manual penetration testing. The publicly available source code allowed us to analyze how the application works, while manual testing enabled us to verify which potential weaknesses were actually exploitable.

We identified a total of 12 findings. The desktop client had one low-severity vulnerability. In the mobile application and server-side components, we identified 11 findings, including one critical vulnerability, one high-severity vulnerability, and one medium-severity vulnerability. Almost all of the more serious findings had a common root cause – the application did not sufficiently validate the inputs it received. The Slovensko.Digital developers subsequently prepared fixes for the identified issues, addressing their common root cause rather than applying separate patches to each individual problem.

“Well-written code that has been reviewed by many people is a major advantage. But it does not reveal how an application will process input that does not have the shape it expected. Security cannot simply be read from the code. It has to be tested.”

Denis, penetration tester at Citadelo

Customer

Slovensko.Digital is a civic association that has been working to improve the quality of government digital services for more than 10 years. One of its own tools is Autogram, an open-source application for electronically signing documents, available for both computers and mobile devices. Autogram is developed in a public repository, and its source code is available to the community. The application has approximately 9,000 active users, and around 100 documents are signed through its mobile version every day on average.