Vulnerabilities / Threats
10/22/2012
01:59 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Popular Android Apps Vulnerable

Security study finds flawed SSL implementations in more than 1,000 Android apps.

About 8% of Android apps are vulnerable to attacks as a result of weak SSL implementations, according to a new computer security study.

Security researchers in Germany analyzed 13,500 free Android apps from Google Play and found that 1,074--about 8%--contain SSL/TLS code that could potentially make them vulnerable to what's known as a Man-in-the-Middle (MITM) attack.

The researchers, from Leibniz University in Hannover and Philipps University in Marburg, describe their findings in a paper titled "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security."

SSL/TLS are cryptographic protocols used to secure online communications. As many security researchers have demonstrated, however, the way these protocols are implemented and their reliance on a trusted third-party Certificate Authority leave many applications vulnerable.

[ Read about Samsung's new Chromebook at Samsung Chromebook: Hands-On Review. ]

This is not a new problem--computer security researcher Moxie Marlinspike released software called sslsniff that demonstrated SSL flaws back in 2002--and more holes keep being found. For instance, researchers from Stanford University and the University of Texas at Austin last week presented a paper titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software." It claims to demonstrate that "SSL certificate validation is completely broken in many security-critical applications and libraries."

In the case of Android apps, the researchers from Germany created a program called MalloDroid to conduct static code analysis on the networking API calls. The program retrieved the http/https URLs from decompiled apps and checked the extracted SSL certificates for validity. It also flagged apps that used custom trust management practices, which may be more permissive than the Android default. The researchers then audited 100 apps manually to look into potential SSL bad practices.

The researchers also examined how the Android apps presented SSL security information to users, to identify poor interface design and possible UI improvements.

In addition to finding 1,074 apps out of 13,500 that accepted all certificates or all hostnames from a certificate--a risky security practice--the researchers through their manual audit found 41 apps out of 100 were vulnerable to MITM attacks.

The vulnerable apps were not identified, but the paper states that three of them have installed bases of between 10 million and 50 million users.

"From these 41 apps, we were able to capture credentials for American Express, Diners Club, Paypal, bank accounts, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, remote control servers, arbitrary email accounts, and IBM Sametime, among others," the researchers state in their paper. "We were able to inject virus signatures into an antivirus app to detect arbitrary apps as a virus or disable virus detection completely."

With regard to the way the apps presented security information, the researchers found that half of 754 Android users surveyed failed to correctly judge the security state of a browser session correctly and that 56% had not seen a certificate security warning before and rated the risk presented in the warning as medium to low.

Google declined to comment.

While the researchers acknowledge that "the default Android browser is exemplary in its SSL use," they nonetheless present several recommendations about how to improve Android security, particularly for third-party apps that use customized SSL code.

They suggest that Google should do the following:

--Disallow custom SSL handling in Android.

--Implement HTTPS-Everywhere as part of its communication API.

--Make its Internet permission model more fine-grained so users can choose to avoid apps without SSL.

--Explore more effective ways to present security information visually to users.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EVVJSK
50%
50%
EVVJSK,
User Rank: Apprentice
10/26/2012 | 7:52:41 PM
re: Popular Android Apps Vulnerable
If the German company is serious about fixing things (and not just making a name for itself), it will have revealed the 41 apps (at a minimum) to Google to allow Google the opportunity to contact the vendor and require fixes (or pull the App from it's market place). Ideally, the Germany company will announce that in 60 days, it is going to release the name of these applications that are vulnerable regarless of a fix being available (to push Google and the App Vendor to fix the problems). It is fine to protect bad practice for a short while to protect users and vendors, but in the long run it is best to have vulnerabilities out in the open so that users can remove software that doesn't protect them !
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.