Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/22/2012
01:59 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Popular Android Apps Vulnerable

Security study finds flawed SSL implementations in more than 1,000 Android apps.

About 8% of Android apps are vulnerable to attacks as a result of weak SSL implementations, according to a new computer security study.

Security researchers in Germany analyzed 13,500 free Android apps from Google Play and found that 1,074--about 8%--contain SSL/TLS code that could potentially make them vulnerable to what's known as a Man-in-the-Middle (MITM) attack.

The researchers, from Leibniz University in Hannover and Philipps University in Marburg, describe their findings in a paper titled "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security."

SSL/TLS are cryptographic protocols used to secure online communications. As many security researchers have demonstrated, however, the way these protocols are implemented and their reliance on a trusted third-party Certificate Authority leave many applications vulnerable.

[ Read about Samsung's new Chromebook at Samsung Chromebook: Hands-On Review. ]

This is not a new problem--computer security researcher Moxie Marlinspike released software called sslsniff that demonstrated SSL flaws back in 2002--and more holes keep being found. For instance, researchers from Stanford University and the University of Texas at Austin last week presented a paper titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software." It claims to demonstrate that "SSL certificate validation is completely broken in many security-critical applications and libraries."

In the case of Android apps, the researchers from Germany created a program called MalloDroid to conduct static code analysis on the networking API calls. The program retrieved the http/https URLs from decompiled apps and checked the extracted SSL certificates for validity. It also flagged apps that used custom trust management practices, which may be more permissive than the Android default. The researchers then audited 100 apps manually to look into potential SSL bad practices.

The researchers also examined how the Android apps presented SSL security information to users, to identify poor interface design and possible UI improvements.

In addition to finding 1,074 apps out of 13,500 that accepted all certificates or all hostnames from a certificate--a risky security practice--the researchers through their manual audit found 41 apps out of 100 were vulnerable to MITM attacks.

The vulnerable apps were not identified, but the paper states that three of them have installed bases of between 10 million and 50 million users.

"From these 41 apps, we were able to capture credentials for American Express, Diners Club, Paypal, bank accounts, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, remote control servers, arbitrary email accounts, and IBM Sametime, among others," the researchers state in their paper. "We were able to inject virus signatures into an antivirus app to detect arbitrary apps as a virus or disable virus detection completely."

With regard to the way the apps presented security information, the researchers found that half of 754 Android users surveyed failed to correctly judge the security state of a browser session correctly and that 56% had not seen a certificate security warning before and rated the risk presented in the warning as medium to low.

Google declined to comment.

While the researchers acknowledge that "the default Android browser is exemplary in its SSL use," they nonetheless present several recommendations about how to improve Android security, particularly for third-party apps that use customized SSL code.

They suggest that Google should do the following:

--Disallow custom SSL handling in Android.

--Implement HTTPS-Everywhere as part of its communication API.

--Make its Internet permission model more fine-grained so users can choose to avoid apps without SSL.

--Explore more effective ways to present security information visually to users.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EVVJSK
50%
50%
EVVJSK,
User Rank: Apprentice
10/26/2012 | 7:52:41 PM
re: Popular Android Apps Vulnerable
If the German company is serious about fixing things (and not just making a name for itself), it will have revealed the 41 apps (at a minimum) to Google to allow Google the opportunity to contact the vendor and require fixes (or pull the App from it's market place). Ideally, the Germany company will announce that in 60 days, it is going to release the name of these applications that are vulnerable regarless of a fix being available (to push Google and the App Vendor to fix the problems). It is fine to protect bad practice for a short while to protect users and vendors, but in the long run it is best to have vulnerabilities out in the open so that users can remove software that doesn't protect them !
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...
CVE-2021-3197
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.