Topic: Android apps vulnerable to "SSL" and "MITM" attacks...

[Samker]

A team of researchers from two German universities has released a study asserting that many of the most popular free apps available through the Google Play store may be vulnerable to "man-in-the-middle" attacks—seriously threatening user privacy.

The researchers, from the Universities of Hannover and Marburg, studied the 13,500 most popular free apps on the Play store for SSL and TLS vulnerabilities. They found that 1,074 of the applications “contain SSL specific code that either accepts all certificates or all hostnames for a certificate and thus are potentially vulnerable to MITM attacks,” according to a summary posted online: http://android-ssl.org/Why_Eve_and_Mallory_Love_Android__An_Analysis_of_Android_SSL_(In)Security/android-ssl.org.html

Additionally, the scientists performed a manual audit of 100 apps for a more definitive look at potential security issues, finding that 41 were open to man-in-the-middle attacks because of SSL vulnerabilities. They said that the vulnerable apps could be exploited, allowing an attacker to steal highly sensitive usernames and passwords for Facebook, WordPress, Twitter, Google, Yahoo and even online banking accounts, among others.

Similar vulnerabilities, the team added, could be used to manipulate antivirus software on the phone, changing definitions to include benign apps or ensure that malicious ones are ignored.

“The cumulative install base of the apps with confirmed vulnerabilities against MITM attacks lies between 39.5 million and 185 million users, according to Google’s Play Market. Actually Google’s Play Market does not give a precise number of installs, instead giving a range. The actual number is likely to be larger, since alternative app markets for Android also contribute to the install base,” the researchers wrote.

According to the H-Online, the team plans to make the code analysis tool it developed for the research public “in the near future”: http://www.h-online.com/security/news/item/Encryption-found-insufficient-in-many-Android-apps-1732847.html

(PCW)

[aardee]

An app that can enable Manual port blocking, like we have an option in Mcafee VSE, would prove to be a superb app, to counter this threat!!