Shocking results awaited us when a survey was carried out recently by a digital security firm, FireEye, on the Android applications. As per the findings, almost 68% of the top 1000 applications in Google Play store are vulnerable to at least one major SSL security flaw. These flaws can range from applications not checking SSL certificates or using obsolete host name verifiers or simply ignoring SSL errors in the Webkit engine that generally signals the security problems. Any single flaw mentioned here is capable enough to enable / permit hackers to carry out Man-in-The-Middle attacks, where the attackers can easily compromise a user’s private data by a malicious party without the developers or the users knowing it. Android Under Attack Android is skillfully designed to be a modern, open-platform for the users. The wealth of Apps available on the Google Play Store is one of the main reason behind the popularity of the Android platform. Android applications use their devices advanced hardware and software along with local and served data, which is exposed through the platform to bring innovation and value to the customers. Now, to sustain this value, the platform needs to offer an application environment, which ensures the security of users’ identity, data, applications, device and the network they are using. However, with each passing day, the number of malicious mobile applications are increasing. These infected/ affected applications can easily access the sensitive information stored on a mobile device. Such compromised information can be used by the hackers to carry out more such attacks with the help of different threat vectors. Applications, as we know, interact with remote servers for their functionality. They normally communicate using either the: HTTP Protocol: This makes the data-interception for others very easy HTTPS Protocol: Due to the security measures involved in this, the data-interception becomes difficult. These security properties in HTTPS stem from the SSL&TLS certificates. The Android platform provides libraries and methods to communicate with the servers by using secure network protocols such as HTTPS, and forming the underpinnings of PKI (Public-Key Infrastructure) implementations. The protocol of SSL/TLS is designed to enhance the security, but incorrect use of the libraries of Android platform can expose applications to MiTM attacks. In such attacks, the attackers can interpret the traffic flowing from the application to the server or vice versa and may: be eavesdropping and accessing the data sent by the server or the application modify the intercepted data or replace it with malicious code or data and re-introduce it in the application and redirect the traffic to an entirely new destination, which is controlled by the attacker. Vulnerable Play Store On July 17 2014, a team of experts at FireEye, reviewed as many as 1000 free applications from Google Play, which are very popular and are downloaded the most. Out of these 1000 applications, 68% (~ 614 applications) had at least one out of three SSL vulnerabilities. The number of vulnerable applications found in each category is presented in the image below:
...read more