Vulnerabilities / Threats
10/22/2012
01:59 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Popular Android Apps Vulnerable

Security study finds flawed SSL implementations in more than 1,000 Android apps.

About 8% of Android apps are vulnerable to attacks as a result of weak SSL implementations, according to a new computer security study.

Security researchers in Germany analyzed 13,500 free Android apps from Google Play and found that 1,074--about 8%--contain SSL/TLS code that could potentially make them vulnerable to what's known as a Man-in-the-Middle (MITM) attack.

The researchers, from Leibniz University in Hannover and Philipps University in Marburg, describe their findings in a paper titled "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security."

SSL/TLS are cryptographic protocols used to secure online communications. As many security researchers have demonstrated, however, the way these protocols are implemented and their reliance on a trusted third-party Certificate Authority leave many applications vulnerable.

[ Read about Samsung's new Chromebook at Samsung Chromebook: Hands-On Review. ]

This is not a new problem--computer security researcher Moxie Marlinspike released software called sslsniff that demonstrated SSL flaws back in 2002--and more holes keep being found. For instance, researchers from Stanford University and the University of Texas at Austin last week presented a paper titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software." It claims to demonstrate that "SSL certificate validation is completely broken in many security-critical applications and libraries."

In the case of Android apps, the researchers from Germany created a program called MalloDroid to conduct static code analysis on the networking API calls. The program retrieved the http/https URLs from decompiled apps and checked the extracted SSL certificates for validity. It also flagged apps that used custom trust management practices, which may be more permissive than the Android default. The researchers then audited 100 apps manually to look into potential SSL bad practices.

The researchers also examined how the Android apps presented SSL security information to users, to identify poor interface design and possible UI improvements.

In addition to finding 1,074 apps out of 13,500 that accepted all certificates or all hostnames from a certificate--a risky security practice--the researchers through their manual audit found 41 apps out of 100 were vulnerable to MITM attacks.

The vulnerable apps were not identified, but the paper states that three of them have installed bases of between 10 million and 50 million users.

"From these 41 apps, we were able to capture credentials for American Express, Diners Club, Paypal, bank accounts, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, remote control servers, arbitrary email accounts, and IBM Sametime, among others," the researchers state in their paper. "We were able to inject virus signatures into an antivirus app to detect arbitrary apps as a virus or disable virus detection completely."

With regard to the way the apps presented security information, the researchers found that half of 754 Android users surveyed failed to correctly judge the security state of a browser session correctly and that 56% had not seen a certificate security warning before and rated the risk presented in the warning as medium to low.

Google declined to comment.

While the researchers acknowledge that "the default Android browser is exemplary in its SSL use," they nonetheless present several recommendations about how to improve Android security, particularly for third-party apps that use customized SSL code.

They suggest that Google should do the following:

--Disallow custom SSL handling in Android.

--Implement HTTPS-Everywhere as part of its communication API.

--Make its Internet permission model more fine-grained so users can choose to avoid apps without SSL.

--Explore more effective ways to present security information visually to users.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EVVJSK
50%
50%
EVVJSK,
User Rank: Apprentice
10/26/2012 | 7:52:41 PM
re: Popular Android Apps Vulnerable
If the German company is serious about fixing things (and not just making a name for itself), it will have revealed the 41 apps (at a minimum) to Google to allow Google the opportunity to contact the vendor and require fixes (or pull the App from it's market place). Ideally, the Germany company will announce that in 60 days, it is going to release the name of these applications that are vulnerable regarless of a fix being available (to push Google and the App Vendor to fix the problems). It is fine to protect bad practice for a short while to protect users and vendors, but in the long run it is best to have vulnerabilities out in the open so that users can remove software that doesn't protect them !
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2014-2640
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-2641
Published: 2014-10-01
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.