2

I have run a heartbleed detector from Lookout on my Android phone. It says:

The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled.

What does it mean by not enabled?

I can see /system/lib/libssl.so file on the phone and found openssl on it. It shows 1.0.1c. Does that mean my phone is vulnerable to heartbleed bug?

My other question is: How I can check whether a particular Android app is vulnerable to heartbleed or not? I don't want to use any third party app. I have seen https://github.com/musalbas/heartbleed-masstest/blob/master/ssltest.py but I want to do it with an app. I don't know the domain name the app is communicating to. Are the app bundle the OpenSSL libraries with apk, If yes how to find the version of OpenSSL being used.

@Solution: I have wriiten python module which takes an APK and it do the check for openSSL version and heartbeat extension.

import zipfile
import os
import re

def heart_bleed(tempdir, msl_outputfile):
    parrent_tempdir = tempdir.split('tmp')[0]
    sslpattern = re.compile("1.0.1[a-f]")
    flagssl = False
    flagheartbleed = False

    msllst_heartbleed = []
    msc_vulid = "heartbleed"
    msc_infoseverity = "Info"
    msc_medseverity = "Medium"
    apkpath = ''
    if (parrent_tempdir):
        for root, dummy_dirs, files in os.walk(parrent_tempdir):
            for allfile in files:
                if allfile.endswith(".apk"):

                    apkpath = os.path.join(root, allfile)

        #print(apkpath)
        with zipfile.ZipFile(apkpath, "r") as msl_apkread:
            for i in msl_apkread.namelist():
                if i.endswith(".so"):
                    data = msl_apkread.read(i)
                    if "part of OpenSSL" in data:
                        start = data.index("part of OpenSSL")
                        resultdata = str(data[start:start+40])
                        sslversion = re.findall(sslpattern, resultdata)
                        if sslversion:
                            flagssl = True

                            if "tls1_heartbeat" in data:
                                flagheartbleed = True

        if flagssl and flagheartbleed:
            print("The App is using OpenSSL version " + sslversion[0] + " which is vulnerable to Heartbleed and Heartbeat extension is enabled."))
        elif flagssl or flagheartbleed:
            print("The App is using OpenSSL version " + sslversion[0] + " which is vulnerable to Heartbleed but Heartbeat extension is disabled."))

Please comment is it right to do ?

Improve this question
4
  • 1
    Say that you don't want to use a 3rd party app, but you want to use an app. That seems confusing and contradictory.
    – schroeder ♦
    Jun 5, 2014 at 21:45
  • Actually I want to make a tool which take and apk and check whether it is vulnerable to heart-bleed or not.
    – Kumar Roshan Mehta
    Jun 6, 2014 at 14:22
  • Then you need to make this 2 questions: "Is my phone vulnerable or not?" and "How do I make my own app to check?" For the second question, you need to ask a different forum.
    – schroeder ♦
    Jun 6, 2014 at 14:26
  • This question keeps mutating. Please generate new questions for new questions.
    – schroeder ♦
    Jun 11, 2014 at 14:26

2 Answers 2

Reset to default
1

Heartbleed is a bug with the 'heartbeat' function within vulnerable versions of SSL. That's why the name 'heartbleed'. Your check is saying that your version is vulnerable, but the heartbeat function is not enabled.

Improve this answer
1
  • How to find whether it is enable or not. I don't trust on any 3rd party app.
    – Kumar Roshan Mehta
    Jun 6, 2014 at 14:23
0

The "SSL Heartbeat" function is an optional part of the OpenSSL library -- one that almost every copy of the library includes. It sounds like your phone is one of the few systems that chose not to include it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .