Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/22/2012
01:59 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Popular Android Apps Vulnerable

Security study finds flawed SSL implementations in more than 1,000 Android apps.

About 8% of Android apps are vulnerable to attacks as a result of weak SSL implementations, according to a new computer security study.

Security researchers in Germany analyzed 13,500 free Android apps from Google Play and found that 1,074--about 8%--contain SSL/TLS code that could potentially make them vulnerable to what's known as a Man-in-the-Middle (MITM) attack.

The researchers, from Leibniz University in Hannover and Philipps University in Marburg, describe their findings in a paper titled "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security."

SSL/TLS are cryptographic protocols used to secure online communications. As many security researchers have demonstrated, however, the way these protocols are implemented and their reliance on a trusted third-party Certificate Authority leave many applications vulnerable.

[ Read about Samsung's new Chromebook at Samsung Chromebook: Hands-On Review. ]

This is not a new problem--computer security researcher Moxie Marlinspike released software called sslsniff that demonstrated SSL flaws back in 2002--and more holes keep being found. For instance, researchers from Stanford University and the University of Texas at Austin last week presented a paper titled "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software." It claims to demonstrate that "SSL certificate validation is completely broken in many security-critical applications and libraries."

In the case of Android apps, the researchers from Germany created a program called MalloDroid to conduct static code analysis on the networking API calls. The program retrieved the http/https URLs from decompiled apps and checked the extracted SSL certificates for validity. It also flagged apps that used custom trust management practices, which may be more permissive than the Android default. The researchers then audited 100 apps manually to look into potential SSL bad practices.

The researchers also examined how the Android apps presented SSL security information to users, to identify poor interface design and possible UI improvements.

In addition to finding 1,074 apps out of 13,500 that accepted all certificates or all hostnames from a certificate--a risky security practice--the researchers through their manual audit found 41 apps out of 100 were vulnerable to MITM attacks.

The vulnerable apps were not identified, but the paper states that three of them have installed bases of between 10 million and 50 million users.

"From these 41 apps, we were able to capture credentials for American Express, Diners Club, Paypal, bank accounts, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, remote control servers, arbitrary email accounts, and IBM Sametime, among others," the researchers state in their paper. "We were able to inject virus signatures into an antivirus app to detect arbitrary apps as a virus or disable virus detection completely."

With regard to the way the apps presented security information, the researchers found that half of 754 Android users surveyed failed to correctly judge the security state of a browser session correctly and that 56% had not seen a certificate security warning before and rated the risk presented in the warning as medium to low.

Google declined to comment.

While the researchers acknowledge that "the default Android browser is exemplary in its SSL use," they nonetheless present several recommendations about how to improve Android security, particularly for third-party apps that use customized SSL code.

They suggest that Google should do the following:

--Disallow custom SSL handling in Android.

--Implement HTTPS-Everywhere as part of its communication API.

--Make its Internet permission model more fine-grained so users can choose to avoid apps without SSL.

--Explore more effective ways to present security information visually to users.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EVVJSK
50%
50%
EVVJSK,
User Rank: Apprentice
10/26/2012 | 7:52:41 PM
re: Popular Android Apps Vulnerable
If the German company is serious about fixing things (and not just making a name for itself), it will have revealed the 41 apps (at a minimum) to Google to allow Google the opportunity to contact the vendor and require fixes (or pull the App from it's market place). Ideally, the Germany company will announce that in 60 days, it is going to release the name of these applications that are vulnerable regarless of a fix being available (to push Google and the App Vendor to fix the problems). It is fine to protect bad practice for a short while to protect users and vendors, but in the long run it is best to have vulnerabilities out in the open so that users can remove software that doesn't protect them !
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.