Vulnerabilities / Threats
10/22/2012
01:59 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Popular Android Apps Vulnerable

Security study finds flawed SSL implementations in more than 1,000 Android apps.

About 8% of Android apps are vulnerable to attacks as a result of weak SSL implementations, according to a new computer security study.

Security researchers in Germany analyzed 13,500 free Android apps from Google Play and found that 1,074--about 8%--contain SSL/TLS code that could potentially make them vulnerable to what's known as a Man-in-the-Middle (MITM) attack.

The researchers, from Leibniz University in Hannover and Philipps University in Marburg, describe their findings in a paper titled "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security."

SSL/TLS are cryptographic protocols used to secure online communications. As many security researchers have demonstrated, however, the way these protocols are implemented and their reliance on a trusted third-party Certificate Authority leave many applications vulnerable.

[ Read about Samsung's new Chromebook at Samsung Chromebook: Hands-On Review. ]

This is not a new problem--computer security researcher Moxie Marlinspike released software called sslsniff that demonstrated SSL flaws back in 2002--and more holes keep being found. For instance, researchers from Stanford University and the University of Texas at Austin last week presented a paper titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software." It claims to demonstrate that "SSL certificate validation is completely broken in many security-critical applications and libraries."

In the case of Android apps, the researchers from Germany created a program called MalloDroid to conduct static code analysis on the networking API calls. The program retrieved the http/https URLs from decompiled apps and checked the extracted SSL certificates for validity. It also flagged apps that used custom trust management practices, which may be more permissive than the Android default. The researchers then audited 100 apps manually to look into potential SSL bad practices.

The researchers also examined how the Android apps presented SSL security information to users, to identify poor interface design and possible UI improvements.

In addition to finding 1,074 apps out of 13,500 that accepted all certificates or all hostnames from a certificate--a risky security practice--the researchers through their manual audit found 41 apps out of 100 were vulnerable to MITM attacks.

The vulnerable apps were not identified, but the paper states that three of them have installed bases of between 10 million and 50 million users.

"From these 41 apps, we were able to capture credentials for American Express, Diners Club, Paypal, bank accounts, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, remote control servers, arbitrary email accounts, and IBM Sametime, among others," the researchers state in their paper. "We were able to inject virus signatures into an antivirus app to detect arbitrary apps as a virus or disable virus detection completely."

With regard to the way the apps presented security information, the researchers found that half of 754 Android users surveyed failed to correctly judge the security state of a browser session correctly and that 56% had not seen a certificate security warning before and rated the risk presented in the warning as medium to low.

Google declined to comment.

While the researchers acknowledge that "the default Android browser is exemplary in its SSL use," they nonetheless present several recommendations about how to improve Android security, particularly for third-party apps that use customized SSL code.

They suggest that Google should do the following:

--Disallow custom SSL handling in Android.

--Implement HTTPS-Everywhere as part of its communication API.

--Make its Internet permission model more fine-grained so users can choose to avoid apps without SSL.

--Explore more effective ways to present security information visually to users.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EVVJSK
50%
50%
EVVJSK,
User Rank: Apprentice
10/26/2012 | 7:52:41 PM
re: Popular Android Apps Vulnerable
If the German company is serious about fixing things (and not just making a name for itself), it will have revealed the 41 apps (at a minimum) to Google to allow Google the opportunity to contact the vendor and require fixes (or pull the App from it's market place). Ideally, the Germany company will announce that in 60 days, it is going to release the name of these applications that are vulnerable regarless of a fix being available (to push Google and the App Vendor to fix the problems). It is fine to protect bad practice for a short while to protect users and vendors, but in the long run it is best to have vulnerabilities out in the open so that users can remove software that doesn't protect them !
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jamie, the darn Unicorn is back."
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.