• Total Posts: 28011
  • Total Topics: 8048
  • Online Today: 715
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: Android apps vulnerable to "SSL" and "MITM" attacks...  (Read 2166 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum
Android apps vulnerable to "SSL" and "MITM" attacks...
« on: 21. October 2012., 08:25:48 »

A team of researchers from two German universities has released a study asserting that many of the most popular free apps available through the Google Play store may be vulnerable to "man-in-the-middle" attacks—seriously threatening user privacy.

The researchers, from the Universities of Hannover and Marburg, studied the 13,500 most popular free apps on the Play store for SSL and TLS vulnerabilities. They found that 1,074 of the applications “contain SSL specific code that either accepts all certificates or all hostnames for a certificate and thus are potentially vulnerable to MITM attacks,” according to a summary posted online:

Additionally, the scientists performed a manual audit of 100 apps for a more definitive look at potential security issues, finding that 41 were open to man-in-the-middle attacks because of SSL vulnerabilities. They said that the vulnerable apps could be exploited, allowing an attacker to steal highly sensitive usernames and passwords for Facebook, WordPress, Twitter, Google, Yahoo and even online banking accounts, among others.

Similar vulnerabilities, the team added, could be used to manipulate antivirus software on the phone, changing definitions to include benign apps or ensure that malicious ones are ignored.

“The cumulative install base of the apps with confirmed vulnerabilities against MITM attacks lies between 39.5 million and 185 million users, according to Google’s Play Market. Actually Google’s Play Market does not give a precise number of installs, instead giving a range. The actual number is likely to be larger, since alternative app markets for Android also contribute to the install base,” the researchers wrote.

According to the H-Online, the team plans to make the code analysis tool it developed for the research public “in the near future”:


Samker's Computer Forum -

Android apps vulnerable to "SSL" and "MITM" attacks...
« on: 21. October 2012., 08:25:48 »


  • SCF Member
  • **
  • Posts: 11
  • KARMA: 1
  • Gender: Male
Re: Android apps vulnerable to "SSL" and "MITM" attacks...
« Reply #1 on: 29. October 2012., 14:09:34 »
An app that can enable Manual port blocking, like we have an option in Mcafee VSE, would prove to be a superb app, to counter this threat!!


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising