Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret?

I know that the IP address and the port number of that connection can be detected, but what about the exact host name and more importantly the URI and/or the query string?

I don't mean just via router or via some other networking 'hack', but also by using some other android app or by using the eclipse plugin.

The app is native and I know how to obfuscate and hide the URL in the code, so it can't be seen by decompiling the app.

share|improve this question
2  
I'm not quite sure what you're looking for. Do you want to know how to check if this sort of information leakage is possible, or how to defend against it, or both? –  Iszi Oct 18 '12 at 13:07
    
If possible, how to defend against it. –  ilija139 Oct 18 '12 at 14:18
    
If someone else isn't sure what I'm asking, please see David Wachtfogel's answer. –  ilija139 Oct 18 '12 at 14:22
2  
Can you refine the question based on Mr. Wachtfogel's answer so that others can search for the question & answer? I suspect that you're not the only one who needs this information. –  Mark C. Wallace Oct 18 '12 at 15:03
    
Protect application from being modified may also be of interest. –  this.josh Oct 19 '12 at 5:52
add comment

3 Answers

up vote 9 down vote accepted

HTTPS (i.e. SSL/TLS) encrypts all HTTP communication including the entire URL. HTTPS does not protect the domain name as this is sent to the DNS in the clear, but it does protect the rest of the URL. Other apps don't have access to your app's SSL/TLS encrypted traffic including URLs. So as long as the SSL/TLS connection is setup securely an attacker won't be able to obtain you URI from the traffic.

But from the last sentence you wrote ("I know how to obfuscate and hide the URL in the code, so it can't be seen by decompiling the app") I understand that you need to protect the URL against an attacker who has full access to the device (e.g. the owner of the device). In this case you can't rely on SSL/TLS connection being secured as it's possible for the atttacker to install his on CA certificate on his device. This completely nullifies the security of SSL/TLS, as the attacker can impersonate your server and perform a man-in-the-middle attack - just like Alexey V. Borodin's hack on Apple in-app purchases. Even if you use a hardcoded SSL certificate the attacker can root the device and modify the O/S to output all SSL/TLS communications in the clear. So HTTPS will not protect your URIs from an attacker running your app on his own device.

share|improve this answer
    
Great answer! This is exactly what I needed, thanks! –  ilija139 Oct 18 '12 at 14:20
1  
This is not possible. The data which is shipped and used by your application cannot be made secret to the owner of the device (it can be obfuscated but you will be able to find it by dumping the memory of the device). If your application needs this to be secret for security then your design is broken. –  ysdx Oct 18 '12 at 14:27
    
Your specific attack doesn't work against applications that use good certificate validation(such as hard-coding the fingerprint), but of course similar attacks still work. An app can't win against the owner of that device. –  CodesInChaos Oct 19 '12 at 9:19
    
@CodesInChaos Good comment - made a small edit to clarify this point –  David Wachtfogel Oct 22 '12 at 8:58
    
Worth noting, feeling I get is you're trying to protect URI strings that the user could use to falsify info on your server (submitting high scores on a game for example). The user could intercept the SSL connection and rewrite POST/GET data this way. Not sure how cert validation happens on Android but if it happens globally they could easily add their MITM CA root. Embedding your own certs would make things slightly trickier but again, de-obfuscating your code would still make URI forging entirely possible. –  deed02392 Jan 17 at 11:47
add comment
  1. Set up an ad-hoc network on a computer.
  2. Make your phone connect to the newly created network
  3. Use Wireshark to see what connections are made
share|improve this answer
    
(I'm not too sure I understand what you want to do. This might be far off) –  Henning Klevjer Oct 18 '12 at 13:00
    
I need to protect the URL against an attacker who has full access to the device (e.g. the owner of the device). –  ilija139 Oct 18 '12 at 14:21
1  
To be boringly academic, the URL is considered public and should not require protection (if I remember correctly). You should try to put the critical data somewhere else. –  Henning Klevjer Oct 18 '12 at 16:26
add comment

In an HTTPS connection the URL data is encrypted. The IP address and port of the server being connected to can be easily enumerated using a packet sniffer, so chances are if the URL can be sniffed the server isn't going to be a secret. Data transmitted within a https (ie SSL/TLS) connection is secret as long as there is no Man in the Middle, see previous discussions about that subject.

If the object is to try and prevent anyone from seeing what system the app is connecting to then the only conceivable way to do it is to tunnel the traffic through a VPN of some kind, and hope that any listener can't sniff the traffic coming out of the other side. Sending your traffic through some sort of anonymizer would accomplish this.

share|improve this answer
    
When using HTTPS, everything at the HTTP level is encrypted, including the URL. What's left visible is the server certificate which give a hint regarding the server name, as ell as the server name indication extension (if it's used). The server name can also be leaked through DNS requests. –  Bruno Oct 18 '12 at 14:51
    
The server name is one thing but the IP address is another and https won't do anything about that. It's hard to be certain what the question is about. –  GdD Oct 18 '12 at 14:56
1  
Sorry if I wasn't clear. It's "The URL is transmitted in the clear" that I'm disagreeing with: the whole HTTP request (including Request Line and Headers, where the URL is) is encrypted in the SSL/TLS connection. Parts of the URL (IP address, port and host name) can be guessed from other means (certificate, SNI, IP address), but that's a different thing. –  Bruno Oct 18 '12 at 15:06
    
You're right, it's not clear what I was trying to say. Edit time! –  GdD Oct 18 '12 at 15:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.